ccdeck 3.33.1 → 3.34.1

package/dist/web/index.html

@@ -62,8 +62,8 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-D7ddxIpC.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BIANlQ9A.css">
+    <script type="module" crossorigin src="/assets/index-CSDSEC1Q.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-DglpEGvW.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ccdeck",
-  "version": "3.33.1",
-  "description": "Live dashboard for Claude Code and Codex — which agent is waiting on you, tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
+  "version": "3.34.1",
+  "description": "Local dashboard for Claude Code and Codex CLI sessions: which Claude Code session needs input, every tool call and Claude Code subagent live, token cost and quota, several Claude accounts. Run npx ccdeck.",
   "type": "module",
   "bin": {
     "ccdeck": "bin/agent-dag.js"
@@ -44,16 +44,21 @@
     "dashboard",
     "monitor",
     "monitoring",
-    "observability",
-    "usage",
     "cost",
-    "tokens",
     "quota",
     "hooks",
     "dag",
     "visualization",
-    "cli",
-    "deck"
+    "claude-code-monitor",
+    "claude-code-sessions",
+    "session-monitor",
+    "codex-dashboard",
+    "claude-code-subagents",
+    "parallel-sessions",
+    "desktop-app",
+    "ccusage",
+    "claude-swap",
+    "local-first"
   ],
   "author": "Bargan Constantin",
   "license": "AGPL-3.0-only",

package/release-notes.json

@@ -60,6 +60,26 @@
     "3.29.9",
     "3.33.1"
   ],
+  "3.34.1": [
+    {
+      "title": "🗂️ The tray menu stays open while you read it",
+      "body": "On Linux the menu behind the tray icon could close by itself while agents were working, often before the row you pressed took the click, so it had to be opened and pressed again. It now changes only when something it says has changed, and stays open while you choose."
+    }
+  ],
+  "3.34.0": [
+    {
+      "title": "🗺️ The network map shows who you are connected to",
+      "body": "Paired decks that are on stand closest to this one, and a light runs along their wires. Paired decks that are away come next, in a colour of their own, with how long they have been gone, and machines that are not paired stand outside in grey. Decks reached over Tailscale sit together in their own shaded slice instead of on dashed wires. Pointing at a deck opens its details beside the map: whether it is there, what to do next if anything, its address and what it runs, and every login the two share, the ones that need a look first."
+    },
+    {
+      "title": "🔑 A login that expired everywhere says so",
+      "body": "When a shared login expired on this deck and every paired deck that is on held an expired copy too, the row said \"Login expired\" and waited for a repair that could never come. It now says \"Login expired on all online decks\". Claude retires a login's other copies each time one machine refreshes it, so shared copies expire together: sign in again on any one machine and the others repair from it on their next round."
+    },
+    {
+      "title": "💬 Send feedback from inside the deck",
+      "body": "Appearance settings has a \"Send feedback…\" button: pick what kind it is, write a title and a few lines, and add a way to reach you if you want an answer. It goes to the people who make ccdeck, who may open a public issue from it, never with your contact in it. If it cannot be sent, the form stays filled in and says why."
+    }
+  ],
   "3.33.0": [
     {
       "title": "🪝 Hooks you add in Claude Code are no longer removed",

package/src/server/deck-prefs.mjs

@@ -78,6 +78,19 @@ export const DEFAULTS = Object.freeze({
   // `auto when idle`, which defaulted on as a localStorage key; it moved here so
   // the server can read it with no page open.
   autoUpdate: true,
+  // ANONYMOUS REPORTS (#1853), ON unless somebody turns them off — the owner's
+  // decision, 2026-09-30: nobody is asked, the README says what is sent, and
+  // Appearance holds the switch. See reports.mjs for what is sent, and
+  // reportsVetoed for the launch-time veto that wins over this.
+  reports: true,
+  // What reports.mjs keeps between runs, and the page never sees
+  // (publicPrefs). `installId` is the random id made at the first check-in and
+  // dropped when reports are switched off; `lastVersion` and `lastActiveDay`
+  // are what the install last said, so an update is told once and "active" at
+  // most once a day; `forget` is an id whose deletion has been asked for and
+  // not yet acknowledged, retried on the next start so switching off while
+  // offline still ends in a deletion.
+  report: Object.freeze({ installId: "", lastVersion: "", lastActiveDay: "", forget: "" }),
   // LAN sync, ON unless somebody turns it off (since 3.22.7; off before).
   // `passphrase` is the only secret this file has ever held, which is why the
   // write below names a mode. AGENTS_DECK_NO_LAN=1 keeps a deck off the network
@@ -266,10 +279,24 @@ export function normalise(raw) {
     notifications: flagOr(src.notifications, DEFAULTS.notifications),
     tourSeen: flagOr(src.tourSeen, DEFAULTS.tourSeen),
     autoUpdate: flagOr(src.autoUpdate, DEFAULTS.autoUpdate),
+    reports: flagOr(src.reports, DEFAULTS.reports),
+    report: normaliseReport(src.report),
     lan: normaliseLan(src.lan),
   };
 }
 
+/** The reporter's own state, coerced: four strings, empty when absent. */
+function normaliseReport(raw) {
+  const src = raw && typeof raw === "object" ? raw : {};
+  const text = v => (typeof v === "string" ? v : "");
+  return {
+    installId: text(src.installId),
+    lastVersion: text(src.lastVersion),
+    lastActiveDay: text(src.lastActiveDay),
+    forget: text(src.forget),
+  };
+}
+
 // How a refusal to write is told — the error writePrefs throws, and the reason
 // and the detail the route hands the panel: prefs-refusal.mjs.
 export { prefsRefusalDetail, prefsWriteRefusal };
@@ -578,7 +605,9 @@ async function save(mutate, home, deps) {
  * page draws. What a page shows is a name and a fingerprint.
  */
 export function publicPrefs(prefs) {
-  const p = normalise(prefs);
+  // The reporter's state is the server's alone: a page has no use for the
+  // install id, and one that could read it could send reports as this install.
+  const { report: _report, ...p } = normalise(prefs);
   // unpaired is engine-authored state too. No page draws or edits it; keeping
   // it out also means a future whole-prefs form cannot replay a stale unpair
   // list over a decision the engine made after the form loaded.
@@ -630,3 +659,10 @@ export function lanEnabled(prefs, env = process.env) {
 export function notificationsVetoed(env = process.env) {
   return env[OFF_ENV] === "1";
 }
+
+/** Did the machine rule out anonymous reports (#1853), whatever the switch says?
+ *  AGENTS_DECK_NO_REPORTS=1 does, and so does AGENTS_DECK_NO_INSTALL=1, which
+ *  the README promises "turns off everything but the quota reads". */
+export function reportsVetoed(env = process.env) {
+  return env.AGENTS_DECK_NO_REPORTS === "1" || env.AGENTS_DECK_NO_INSTALL === "1";
+}

package/src/server/index.mjs

@@ -135,6 +135,10 @@ import { applyLanPrefs, resetLanLoaded } from "./lan-deck.mjs";
 import { handleLanInvite, handleLanPeer, handleLanStatus, handleLanSync } from "./lan-routes.mjs";
 // GET and POST /api/prefs — see prefs-routes.mjs.
 import { handlePrefsGiveBack, handlePrefsRead, handlePrefsWrite } from "./prefs-routes.mjs";
+// Anonymous reports and the feedback dialog (#1853). The requests to
+// api.ccdeck.dev are made in reports.mjs, never in this file.
+import { handleClientError, handleFeedback, handleReportsWrite } from "./reports-routes.mjs";
+import { reporter } from "./reports.mjs";
 import { MANIFEST_PATH, offerManifest } from "./app-manifest.mjs";
 import { historySnapshot, processesReply, readProcesses, startSystemMetrics, systemSnapshot } from "./system-metrics.mjs";
 // How every route reads a body and answers, and the answer for one that threw
@@ -213,7 +217,14 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
   // default for an unhandled rejection is to kill the process, which would
   // take the whole deck down — SSE stream, hook ingest and all — because one
   // background quota poll hit a network error. Answer the request instead.
-  const guard = (p, res) => Promise.resolve(p).catch(err => sendInternalError(res, err));
+  //
+  // The error also goes to reporter.reportError, which sends it (scrubbed)
+  // unless reports are switched off or vetoed, and never throws.
+  const failed = (res, err) => {
+    sendInternalError(res, err);
+    reporter.reportError("server", err).catch(() => {});
+  };
+  const guard = (p, res) => Promise.resolve(p).catch(err => failed(res, err));
 
   // Which of the eleven candidates below this deck ended up on, set the moment
   // one of them binds. Declared here rather than beside the loop that fills it
@@ -295,6 +306,9 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
     if (req.method === "POST" && url.pathname === "/api/lan/sync")     return guard(handleLanSync(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/prefs")        return guard(handlePrefsWrite(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/prefs/give-back") return guard(handlePrefsGiveBack(req, res), res);
+    if (req.method === "POST" && url.pathname === "/api/reports")      return guard(handleReportsWrite(req, res), res);
+    if (req.method === "POST" && url.pathname === "/api/feedback")     return guard(handleFeedback(req, res), res);
+    if (req.method === "POST" && url.pathname === "/api/client-error") return guard(handleClientError(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/system")       return send(res, 200, systemSnapshot());
     // On demand only — the process list costs a subprocess on every platform,
     // so it is fetched while the detail panel is open and never on the timer.
@@ -430,7 +444,7 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
     try {
       route(req, res);
     } catch (err) {
-      sendInternalError(res, err);
+      failed(res, err);
     }
   });
 
@@ -467,6 +481,10 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
       // deck that had it on comes back with it on, and a launcher that only
       // asked the registry never binds a port it is about to walk away from.
       prefsRead.then(() => applyLanPrefs()).catch(() => {});
+      // Anonymous reports (#1853): what is due once the prefs are read, then a
+      // check every few hours on an unref'd timer. Switched off in Appearance,
+      // or with AGENTS_DECK_NO_REPORTS / AGENTS_DECK_NO_INSTALL, nothing is sent.
+      reporter.start();
       // Auto-switch resumes only if the user previously turned it on; the
       // module reads its own persisted flag and does nothing otherwise. Its
       // ticks wait for `cswapQuiet`, the launcher's word that claude-swap is not

package/src/server/prefs-routes.mjs

@@ -7,7 +7,7 @@
 // engine had (lan-deck.mjs): what is left of them is a body read, a write
 // through the one, a push to the other, and an answer. The notifier stays in
 // index.mjs, beside the desktop-app connections it notifies through.
-import { notificationsOn, notificationsVetoed, prefsRefusalDetail, prefsWriteRefusal, publicPrefs } from "./deck-prefs.mjs";
+import { notificationsOn, notificationsVetoed, prefsRefusalDetail, prefsWriteRefusal, publicPrefs, reportsVetoed } from "./deck-prefs.mjs";
 import { PRODUCT } from "./brand.mjs";
 import { heldPrefs } from "./prefs-state.mjs";
 import { applyLanPrefs, forgetReach, resetLanLoaded } from "./lan-deck.mjs";
@@ -38,6 +38,7 @@ function prefsPayload() {
     prefs: publicPrefs(prefs),
     notificationsAllowed: notificationsOn(prefs),
     notificationsVetoed: notificationsVetoed(),
+    reportsVetoed: reportsVetoed(),
   };
 }
 
@@ -51,8 +52,12 @@ export async function handlePrefsWrite(req, res) {
   let body = null;
   try { body = JSON.parse(raw ?? ""); } catch { /* handled below */ }
   if (!body || typeof body !== "object") return send(res, 400, { ok: false, reason: "bad_request" });
+  // The reports switch has consequences a plain write would skip — a deletion
+  // asked for — so it is changed only through /api/reports, and its state never
+  // by the page at all (#1853).
+  const { reports: _reports, report: _report, ...patch } = body;
   try {
-    await heldPrefs.write(body);
+    await heldPrefs.write(patch);
   } catch (err) {
     // A settings file or folder this user cannot reach is the machine's to fix,
     // not the deck's, and `guard`'s bare 500 left the panel with nothing to say

package/src/server/reports-routes.mjs

@@ -0,0 +1,75 @@
+// The page's three ways into reports.mjs (#1853): the switch in Appearance, an
+// error the page caught, and the feedback dialog. The page never
+// talks to api.ccdeck.dev itself — this server does, which is also why the
+// install id never has to reach the page.
+
+import { reportsVetoed } from "./deck-prefs.mjs";
+import { readBody, send } from "./http-io.mjs";
+import { heldPrefs } from "./prefs-state.mjs";
+import { REPORTS_API, installFacts, reporter } from "./reports.mjs";
+
+async function readJson(req, res, limit) {
+  const raw = await readBody(req, res, limit).catch(() => null);
+  try {
+    const body = JSON.parse(raw ?? "");
+    return body && typeof body === "object" ? body : null;
+  } catch {
+    return null;
+  }
+}
+
+/** `POST /api/reports` `{ on }`: Appearance's "Send anonymous reports" switch. */
+export async function handleReportsWrite(req, res, { report = reporter } = {}) {
+  const body = await readJson(req, res, 1_000);
+  if (typeof body?.on !== "boolean") return send(res, 400, { ok: false, reason: "bad_request" });
+  await report.setReports(body.on);
+  return send(res, 200, { ok: true, reports: heldPrefs.current().reports, reportsVetoed: reportsVetoed() });
+}
+
+/** `POST /api/client-error` `{ message, stack? }`: an error the page caught. Sent on only while reports are on. */
+export async function handleClientError(req, res, { report = reporter } = {}) {
+  const body = await readJson(req, res, 16_000);
+  if (typeof body?.message !== "string") return send(res, 400, { ok: false, reason: "bad_request" });
+  const stack = typeof body.stack === "string" ? body.stack : undefined;
+  const sent = await report.reportError("web", { message: body.message, stack });
+  return send(res, 202, { ok: true, sent });
+}
+
+/**
+ * `POST /api/feedback` `{ kind, title, body, contact? }`: the feedback dialog.
+ *
+ * The API stores it, and the people who make ccdeck read it there. They may
+ * open a public issue from it, never with the contact; nothing becomes public
+ * by being sent, which is why the answer to the page is a plain "it arrived"
+ * and carries no link.
+ *
+ * Not gated on the reports switch: pressing Send is its own decision, for this
+ * one message. AGENTS_DECK_NO_INSTALL=1 still wins, because the README promises
+ * that it "turns off everything but the quota reads", and a launch script's
+ * word about the machine outranks a button on the page.
+ */
+export async function handleFeedback(req, res, { fetchImpl = globalThis.fetch, env = process.env } = {}) {
+  if (env.AGENTS_DECK_NO_INSTALL === "1") return send(res, 403, { ok: false, reason: "vetoed" });
+  const body = await readJson(req, res, 32_000);
+  if (!body) return send(res, 400, { ok: false, reason: "bad_request" });
+  const facts = installFacts({ env });
+  const contact = typeof body.contact === "string" && body.contact.trim() ? body.contact.trim() : undefined;
+  try {
+    const upstream = await fetchImpl(`${REPORTS_API}/v1/feedback`, {
+      method: "POST",
+      headers: { "content-type": "application/json", "user-agent": `ccdeck/${facts.version}` },
+      body: JSON.stringify({
+        kind: body.kind, title: body.title, body: body.body, contact,
+        appVersion: facts.version, platform: `${facts.os}-${facts.arch}`,
+      }),
+      signal: AbortSignal.timeout(20_000),
+    });
+    const answer = await upstream.json().catch(() => null);
+    if (upstream.status === 202) return send(res, 200, { ok: true });
+    if (upstream.status === 400) return send(res, 400, { ok: false, reason: "invalid", errors: answer?.errors ?? {} });
+    if (upstream.status === 429) return send(res, 429, { ok: false, reason: "too_many" });
+    return send(res, 502, { ok: false, reason: "unavailable" });
+  } catch {
+    return send(res, 502, { ok: false, reason: "unavailable" });
+  }
+}

package/src/server/reports.mjs

@@ -0,0 +1,252 @@
+// Anonymous reports, on unless the person switched them off (#1853).
+//
+// WHAT GOES OUT, to api.ccdeck.dev, while `prefs.reports` is true and the
+// machine has not vetoed it (reportsVetoed):
+//
+//   - an "install" event the first time,
+//   - an "update" event, with the version it came from, when the version moves,
+//   - an "active" event at most once a UTC day, which is how many people use
+//     ccdeck gets counted without counting anything else about them,
+//   - errors: a request handler that threw on this server, or an error the page
+//     caught, with home folders, email addresses and key-shaped strings
+//     scrubbed out before they leave.
+//
+// Each carries the install id, the version, the OS and CPU architecture, the
+// channel (the desktop app, npm, or a source checkout) and the runtime. Nothing about a session, a
+// project, a prompt, a path or a person: the install id is random, made at the
+// first check-in, and tied to nothing on the machine.
+//
+// NOBODY IS ASKED, AND NOTHING IS HIDDEN. The owner chose on-by-default
+// (2026-09-30): the README says what is sent, Appearance holds the switch, and
+// AGENTS_DECK_NO_REPORTS=1 keeps it off from the first start.
+//
+// SWITCHING IT OFF DELETES WHAT WAS SENT. The id is forgotten here and the API
+// is asked to drop every event and error it holds for it; if that request
+// cannot get through, the id waits in `report.forget` and the ask is repeated
+// on the next start, so switching off while offline still ends in a deletion.
+//
+// NOTHING HERE THROWS OR WAITS FOR ANYBODY. A report that cannot be sent is
+// dropped: it is a nicety for the people who make ccdeck, and no part of the
+// deck depends on it.
+
+import { randomUUID } from "node:crypto";
+import { homedir } from "node:os";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { inApp } from "./app-host.mjs";
+import { reportsVetoed } from "./deck-prefs.mjs";
+import { isGitCheckout } from "./install-layout.mjs";
+import { heldPrefs, prefsRead } from "./prefs-state.mjs";
+import { RUNNING_VERSION } from "./running-version.mjs";
+
+export const REPORTS_API = "https://api.ccdeck.dev";
+const PKG_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const TIMEOUT_MS = 6000;
+/** How often a long-running deck checks whether a new day wants its "active". */
+const CHECK_IN_EVERY_MS = 6 * 60 * 60 * 1000;
+/** Errors per hour this deck may send, and how long one error is not repeated. */
+const ERRORS_PER_HOUR = 20;
+const SAME_ERROR_QUIET_MS = 60 * 60 * 1000;
+const MESSAGE_MAX = 500;
+const STACK_MAX = 4000;
+
+const EMPTY_REPORT = Object.freeze({ installId: "", lastVersion: "", lastActiveDay: "", forget: "" });
+
+/** Is this deck sending reports right now? The switch, which is on unless
+ *  somebody turned it off, and the machine's consent. */
+export function reportsOn(prefs, env = process.env) {
+  return !reportsVetoed(env) && prefs?.reports !== false;
+}
+
+/** What every report says about the install, and nothing else. */
+export function installFacts({
+  version = RUNNING_VERSION,
+  platform = process.platform,
+  arch = process.arch,
+  versions = process.versions,
+  env = process.env,
+  checkout = isGitCheckout(PKG_ROOT),
+} = {}) {
+  return {
+    version: String(version),
+    os: platform,
+    arch,
+    // A deck run out of a git checkout is somebody developing ccdeck, and it
+    // says so, so the people counting installs can leave it out.
+    channel: inApp(env) ? "desktop" : checkout ? "checkout" : "npm",
+    runtime: versions.electron ? `electron-${versions.electron}` : `node-${versions.node}`,
+  };
+}
+
+/**
+ * Take out of an error what could say who someone is.
+ *
+ * The catch-all for long opaque strings deliberately stops at a slash: with one
+ * in it, the pattern swallowed every long file path, and a stack whose frames
+ * read `at save (~/.<secret>.mjs:40:3)` tells nobody where the bug is.
+ * The API scrubs again;
+ * this is the pass that means it never has to: this user's home folder, anyone
+ * else's home folder, email addresses, and strings shaped like keys and tokens.
+ */
+export function scrub(text, home = homedir()) {
+  let out = String(text ?? "");
+  if (home && home.length > 1) out = out.split(home).join("~");
+  return out
+    .replace(/\/(?:home|Users)\/[^/\s:'"]+/g, "~")
+    .replace(/[A-Za-z]:\\(?:Users|Documents and Settings)\\[^\\\r\n:'"]+/gi, "~")
+    .replace(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, "<email>")
+    .replace(
+      /\b(?:sk-ant-[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abpr]-[A-Za-z0-9-]{10,}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|[A-Fa-f0-9]{40,}|[A-Za-z0-9+_=-]{48,})/g,
+      "<secret>",
+    );
+}
+
+/**
+ * The reporter, with everything it touches passed in so the suite can run it
+ * against a fake API, a fake clock and a prefs store in memory.
+ *
+ * @param {object} [deps]
+ * @param {typeof fetch} [deps.fetchImpl]
+ * @param {() => Date} [deps.now]
+ * @param {{ current: () => any, update: (mutate: (prev: any) => any) => Promise<any> }} [deps.prefs]
+ * @param {NodeJS.ProcessEnv} [deps.env]
+ * @param {ReturnType<typeof installFacts>} [deps.facts]
+ * @param {string} [deps.home]
+ * @param {Promise<unknown>} [deps.ready] what start() waits for: the prefs read at import
+ */
+export function createReporter({
+  fetchImpl = globalThis.fetch,
+  now = () => new Date(),
+  prefs = heldPrefs,
+  env = process.env,
+  facts = installFacts({ env }),
+  home = homedir(),
+  ready = prefsRead,
+} = {}) {
+  const errorsSent = [];
+  const lastSentAt = new Map();
+  let timer = null;
+
+  async function call(method, path, body) {
+    try {
+      const res = await fetchImpl(REPORTS_API + path, {
+        method,
+        headers: { "content-type": "application/json", "user-agent": `ccdeck/${facts.version}` },
+        body: body === undefined ? undefined : JSON.stringify(body),
+        signal: AbortSignal.timeout(TIMEOUT_MS),
+      });
+      return res.ok;
+    } catch {
+      return false;
+    }
+  }
+
+  /** Change the reporter's state, but only while it still belongs to `installId`:
+   *  a switch-off that landed in between has the last word. */
+  function remember(installId, change) {
+    return prefs.update(prev =>
+      prev.report.installId === installId ? { report: { ...prev.report, ...change } } : undefined,
+    );
+  }
+
+  /** Send whatever is due: a pending deletion, then install or update, then
+   *  today's "active". Never throws: a floating rejection here would be an
+   *  unhandled one, and Node's answer to those is to end the process. */
+  async function checkIn() {
+    try {
+      await sendWhatIsDue();
+    } catch {
+      // A settings file that cannot be written this minute; the next check-in tries again.
+    }
+  }
+
+  async function sendWhatIsDue() {
+    // The machine's veto covers the deletion too: a deck launched to stay off
+    // the network stays off it, and the deletion waits for a launch without it.
+    if (reportsVetoed(env)) return;
+    const p = prefs.current();
+    const { forget } = p.report ?? EMPTY_REPORT;
+    if (forget && (await call("DELETE", `/v1/app/installs/${encodeURIComponent(forget)}`))) {
+      await prefs.update(prev => (prev.report.forget === forget ? { report: { ...prev.report, forget: "" } } : undefined));
+    }
+    if (!reportsOn(prefs.current(), env)) return;
+
+    // The id is made here, the first time there is something to send under it.
+    if (!prefs.current().report.installId) {
+      await prefs.update(prev =>
+        prev.reports === false || prev.report.installId ? undefined : { report: { ...prev.report, installId: randomUUID() } },
+      );
+    }
+    const { installId, lastVersion, lastActiveDay } = prefs.current().report;
+    if (!installId) return;
+    if (!lastVersion) {
+      if (await call("POST", "/v1/app/events", { installId, kind: "install", ...facts })) {
+        await remember(installId, { lastVersion: facts.version });
+      }
+    } else if (lastVersion !== facts.version) {
+      if (await call("POST", "/v1/app/events", { installId, kind: "update", fromVersion: lastVersion, ...facts })) {
+        await remember(installId, { lastVersion: facts.version });
+      }
+    }
+
+    const today = now().toISOString().slice(0, 10);
+    if (lastActiveDay !== today && (await call("POST", "/v1/app/events", { installId, kind: "active", ...facts }))) {
+      await remember(installId, { lastActiveDay: today });
+    }
+  }
+
+  /** The switch. On checks in, which makes an id if there is none; off drops the id and asks for a deletion. */
+  async function setReports(on) {
+    if (on) {
+      await prefs.update(() => ({ reports: true }));
+      await checkIn();
+      return;
+    }
+    await prefs.update(prev => ({
+      reports: false,
+      report: { ...EMPTY_REPORT, forget: prev.report.installId || prev.report.forget },
+    }));
+    await checkIn();
+  }
+
+  /**
+   * Report an error, scrubbed. At most ERRORS_PER_HOUR an hour, and the same
+   * message is not repeated within SAME_ERROR_QUIET_MS: a handler that fails on
+   * every poll would otherwise send the same line all day.
+   */
+  async function reportError(where, error) {
+    const p = prefs.current();
+    if (!reportsOn(p, env) || !p.report.installId) return false;
+    const message = scrub(error?.message ?? error, home).slice(0, MESSAGE_MAX).trim();
+    if (!message) return false;
+    const at = now().getTime();
+    while (errorsSent.length && at - errorsSent[0] > SAME_ERROR_QUIET_MS) errorsSent.shift();
+    const key = `${where}\n${message}`;
+    if (errorsSent.length >= ERRORS_PER_HOUR || at - (lastSentAt.get(key) ?? -Infinity) < SAME_ERROR_QUIET_MS) return false;
+    errorsSent.push(at);
+    lastSentAt.set(key, at);
+    const stack = typeof error?.stack === "string" ? scrub(error.stack, home).slice(0, STACK_MAX) : undefined;
+    const { runtime: _runtime, ...fields } = facts;
+    return call("POST", "/v1/app/errors", { installId: p.report.installId, ...fields, where, message, stack });
+  }
+
+  /** Check in once the prefs are read, and every few hours after, on a timer
+   *  that never holds the process open. */
+  function start() {
+    Promise.resolve(ready).catch(() => {}).then(checkIn);
+    if (!timer) {
+      timer = setInterval(() => void checkIn(), CHECK_IN_EVERY_MS);
+      timer.unref?.();
+    }
+  }
+
+  function stop() {
+    if (timer) clearInterval(timer);
+    timer = null;
+  }
+
+  return { checkIn, setReports, reportError, start, stop };
+}
+
+/** The deck's own reporter. */
+export const reporter = createReporter();