ccdeck 3.36.0 → 3.36.3

package/src/server/claude-accounts.mjs

@@ -47,6 +47,10 @@ export { verdictNow, verdictsNow } from "./claude-verdicts.mjs";
 // Asking claude-swap to collect, which every roster read does when something is
 // due, and when each account will next be read.
 import { nextReadAt, nudgeCollector } from "./claude-collector.mjs";
+// Which accounts the deck signed in itself, and the incident one of them is in
+// (#1893). Pure, and keyed the way LAN sync keys accounts.
+import { hasRecovered, reauthFor } from "./account-origins.mjs";
+import { accountKey } from "./lan-copies.mjs";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
 import { homedir, platform } from "node:os";
@@ -349,6 +353,53 @@ function repairFor(num, email, now) {
   try { return _repairStaleCopy({ num, email, now }) ?? null; } catch { return null; }
 }
 
+// ── which accounts the deck signed in (#1893) ────────────────────────────────
+//
+// HANDED IN, NOT IMPORTED, for the stale-copy repair's reason: what the deck
+// remembers lives in prefs.json, and this module is read by dozens of tests
+// against fixture stores that must never reach the user's own settings. The
+// server hands it in when it starts listening (wireAccountOrigins, in
+// account-routes.mjs); with nothing handed in, no row has an origin.
+let _origins = null;
+
+/**
+ * `{ entries, tidy }`: `entries()` answers prefs.json's `accounts` map as held
+ * in memory, and `tidy({ recovered, gone })` is told what a read found out of
+ * date in it — accounts read well after an incident somebody put off, and
+ * accounts no longer in the store at all. Null unregisters.
+ */
+export function accountOriginsWith(source) {
+  _origins = source && typeof source.entries === "function" ? source : null;
+}
+
+/** The map as it stands. One that throws costs the roster its origins, never
+ *  the read. */
+function originsNow() {
+  try { return _origins?.entries() ?? {}; } catch { return {}; }
+}
+
+/**
+ * Tell the registered source what this read found out of date.
+ *
+ * GONE IS EVERY MARKED IDENTITY THE STORE NO LONGER HOLDS, however it left: the
+ * panel's remove, `cswap remove` in a terminal, a hand edit. Kept, a mark would
+ * outlive its account and land on the same address arriving later by a share or
+ * Local network — exactly what the mark must never be. Safe to decide off one
+ * read: claude-swap replaces sequence.json whole (temp file and rename), and an
+ * import refreshes a slot in place rather than removing it first. Asked of every
+ * account in the store, not of the ordered list drawn above, and never of a
+ * store with none: an emptied store is the one state where waiting costs
+ * nothing.
+ */
+function tidyOrigins(origins, recovered, held) {
+  const present = new Set(Object.values(held ?? {}).map(a => accountKey(a?.email, a?.organizationUuid)));
+  const gone = present.size ? Object.keys(origins).filter(k => !present.has(k)) : [];
+  if (!recovered.length && !gone.length) return;
+  // `seen` rides along so the write changes only what this read judged: a mark
+  // re-made, or an incident put off, since then is not this read's to undo.
+  try { _origins?.tidy?.({ recovered, gone, seen: origins }); } catch { /* the next read says it again */ }
+}
+
 /**
  * The read itself, split out from the admission control above it so the guard is
  * readable as the four lines it is.
@@ -385,6 +436,11 @@ async function readRoster(now, gen) {
     return finish({ ok: false, reason: "cswap_refused", version: refused.version, want: refused.want ?? null, fetchedAt: now });
   }
 
+  // What the deck remembers about its accounts, taken BEFORE the store is read
+  // (#1893). A sign-in marks its account only after `cswap add` has written
+  // it, so every mark in this copy names an account the store read below
+  // already holds — and none recorded mid-read can be mistaken for one gone.
+  const origins = originsNow();
   const root = backupRoot();
   const seq  = await readSequence(root);
   if (!seq?.accounts) {
@@ -422,13 +478,22 @@ async function readRoster(now, gen) {
     : Object.keys(seq.accounts).sort((a, b) => Number(a) - Number(b));
 
   const accounts = [];
+  const recovered = [];
   for (const num of order) {
     const acct = seq.accounts[num];
     if (!acct) continue;                       // sequence lists a slot that no longer exists
 
     const row = rows[num];
-    accounts.push(rosterRow({ seq, num, acct, row, identity, now }));
+    const key = accountKey(acct.email, acct.organizationUuid);
+    const origin = Object.hasOwn(origins, key) ? origins[key] : null;
+    const shown = rosterRow({ seq, num, acct, row, identity, now, key, origin });
+    accounts.push(shown);
+    // A put-off incident is over once a read succeeds after it, and the
+    // put-off goes with it (#1893) — said here, where the read is, rather than
+    // left for the page to notice.
+    if (origin && hasRecovered(origin, shown.fetchedAt)) recovered.push(key);
   }
+  tidyOrigins(origins, recovered, seq.accounts);
 
   return finish({ ok: true, accounts, activeNum: seq.activeAccountNumber ?? null, fetchedAt: now });
 }
@@ -443,11 +508,14 @@ async function readRoster(now, gen) {
  * verdict cache, and asks the registered repair about a `stale-copy` row —
  * which is what starts that repair (see repairStaleCopyWith).
  */
-function rosterRow({ seq, num, acct, row, identity, now }) {
+function rosterRow({ seq, num, acct, row, identity, now, key, origin = null }) {
   const matches = rowIsFor(row, acct);
   const good = matches ? row.lastGood : null;
 
   const fetchedAtMs = matches && typeof row.fetchedAt === "number" ? row.fetchedAt * 1000 : null;
+  // When claude-swap last TRIED, well or not. A refusal counts against a login
+  // only when it came after the deck last signed that login in (#1893).
+  const attemptedAtMs = matches && typeof row.lastAttemptAt === "number" ? row.lastAttemptAt * 1000 : null;
   const isActive = String(seq.activeAccountNumber) === num;
   const trouble = authTrouble(row, {
     matches, isActive, identity, email: acct.email, fetchedAt: fetchedAtMs, now,
@@ -462,6 +530,7 @@ function rosterRow({ seq, num, acct, row, identity, now }) {
   ].filter(Boolean);
 
   const collector = verdictFor(num, now, acct.email, acct.organizationUuid);
+  const reauth = reauthFor({ entry: origin, trouble, collector, fetchedAt: fetchedAtMs, attemptedAt: attemptedAtMs });
   return {
     num:      Number(num),
     email:    acct.email ?? null,
@@ -520,6 +589,13 @@ function rosterRow({ seq, num, acct, row, identity, now }) {
     // what turns "not collecting" into a sentence with a next step in it, and
     // it is null on every machine where the collector has not been asked yet.
     collector,
+    // "ccdeck_signin" when the deck's own `+ → Sign in` added this account,
+    // and null for every other way an account arrives (#1893).
+    origin: origin?.origin ?? null,
+    // The incident this account is in, when it is one the deck signed in and
+    // claude-swap has refused its login since: `{ key, since, dismissed }`.
+    // `key` and `since` together name it, for "Not now" to send back.
+    reauth: reauth ? { key, ...reauth } : null,
   };
 }
 

package/src/server/cswap-admin.mjs

@@ -36,6 +36,29 @@ import { PRODUCT } from "./brand.mjs";
 // open longer than a user would plausibly take to fetch one.
 const LOGIN_TIMEOUT_MS = 5 * 60_000;
 const CSWAP_TIMEOUT_MS = 60_000;
+
+// ── telling the deck what it signed in (#1893) ──────────────────────────────
+//
+// A completed `+ → Sign in` is the one moment the deck knows where an account
+// came from. It is told to whoever registered here — account-routes.mjs, which
+// keeps the answer in prefs.json — rather than written from this module: tests
+// drive the sign-in against fixture stores, and none of them may reach the
+// user's own settings. (Forgetting is the roster's: an account gone from the
+// store, however it went, is dropped on the next read.)
+let _origins = null;
+
+/** `{ signedIn({email, org, added}) }`, or null. */
+export function accountOriginsWith(hooks) {
+  _origins = hooks && typeof hooks === "object" ? hooks : null;
+}
+
+/** Tell the registered hook, and never let its failure become the flow's: an
+ *  account that was signed in is signed in whether or not this was kept. */
+async function tellOrigins(event, detail) {
+  try { await _origins?.[event]?.(detail); }
+  catch (err) { console.error(`${PRODUCT}: could not note where an account came from:`, err?.message ?? err); }
+}
+
 // ── whether this process can read what claude-swap holds ────────────────────
 //
 // ASKED OF CLAUDE-SWAP, NEVER READ OFF ITS WORDS. A Keychain it cannot open is
@@ -259,6 +282,28 @@ export function newSlot(before, after) {
   return fresh.length === 1 ? fresh[0] : null;
 }
 
+const sameAddress = (a, b) => String(a ?? "").trim().toLowerCase() === String(b ?? "").trim().toLowerCase();
+
+/**
+ * The slot a store holds for the identity the CLI reports, or null.
+ *
+ * Case-folded, because the CLI and the store need not spell an address alike,
+ * and by organization too when the CLI names one: one address under two
+ * organizations is two accounts, and the first slot with the address is not
+ * necessarily the one that was signed into (#1893). Without an organization to
+ * go on, the first slot with the address is still the best answer there is.
+ */
+export function slotOf(store, identity) {
+  const mine = store.slots.filter(s => sameAddress(store.emails[s], identity?.email));
+  const org = identity?.orgId ?? "";
+  return (org ? mine.find(s => (store.orgs?.[s] ?? "") === org) : null) ?? mine[0] ?? null;
+}
+
+/** Whether a store held this exact account — address and organization. */
+export function holds(store, email, org) {
+  return store.slots.some(s => sameAddress(store.emails[s], email) && (store.orgs?.[s] ?? "") === (org ?? ""));
+}
+
 
 // ── login ────────────────────────────────────────────────────────────────────
 
@@ -665,7 +710,23 @@ async function registerSignedIn(flow, identity) {
     const slot = newSlot(flow.before, after);
     // No new slot means the account was already managed and cswap refreshed its
     // credentials in place. That is a success with a different sentence.
-    const num = slot ?? Object.keys(after.emails).find(k => after.emails[k] === identity.email) ?? null;
+    const num = slot ?? slotOf(after, identity) ?? null;
+
+    // Recorded now that claude-swap holds the account, and before the roster
+    // is invalidated below, so no read can land between the two and cache a
+    // row that does not know the deck signed it in (#1893). The store, not the
+    // CLI, supplies the organization: claude-swap keys the account by both.
+    //
+    // ADDED MEANS "NOT THERE WHEN THE SIGN-IN STARTED", asked of the identity
+    // rather than of newSlot. `flow.before` is minutes old by now, and a share
+    // or a Local network round can land a different account in between: two
+    // new slots, newSlot answers null, and the account this sign-in did add
+    // would never be marked.
+    if (num != null) {
+      const email = after.emails[num] || identity.email;
+      const org = after.orgs?.[num] ?? "";
+      await tellOrigins("signedIn", { email, org, added: !holds(flow.before, email, org) });
+    }
 
     // Assigned, not discarded. `done` is still the right state — the account
     // WAS added — but it is `done` with a qualification whenever this says the

package/src/server/deck-prefs.mjs

@@ -45,6 +45,7 @@ import { NOT_JSON, prefsRefusalDetail, prefsWriteRefusal, unreadablePrefs } from
 import { DENIED, foreignPath, quarantinePath, setAsideForeign } from "./prefs-set-aside.mjs";
 import { deckDataDir } from "./deck-home.mjs";
 import { PRODUCT } from "./brand.mjs";
+import { normaliseOrigins } from "./account-origins.mjs";
 
 /** Set to "1" to keep the deck off the desktop whatever the stored preference
  *  says. Same sheet of switches as AGENTS_DECK_NO_DOWNLOAD and
@@ -91,6 +92,10 @@ export const DEFAULTS = Object.freeze({
   // not yet acknowledged, retried on the next start so switching off while
   // offline still ends in a deletion.
   report: Object.freeze({ installId: "", lastVersion: "", lastActiveDay: "", forget: "" }),
+  // The accounts this deck signed in itself, and the re-sign-in prompts
+  // somebody put off (#1893) — keyed by account identity, written by the deck
+  // and never by a page. See account-origins.mjs.
+  accounts: Object.freeze({}),
   // LAN sync, ON unless somebody turns it off (since 3.22.7; off before).
   // `passphrase` is the only secret this file has ever held, which is why the
   // write below names a mode. AGENTS_DECK_NO_LAN=1 keeps a deck off the network
@@ -281,6 +286,7 @@ export function normalise(raw) {
     autoUpdate: flagOr(src.autoUpdate, DEFAULTS.autoUpdate),
     reports: flagOr(src.reports, DEFAULTS.reports),
     report: normaliseReport(src.report),
+    accounts: normaliseOrigins(src.accounts),
     lan: normaliseLan(src.lan),
   };
 }
@@ -607,7 +613,9 @@ async function save(mutate, home, deps) {
 export function publicPrefs(prefs) {
   // The reporter's state is the server's alone: a page has no use for the
   // install id, and one that could read it could send reports as this install.
-  const { report: _report, ...p } = normalise(prefs);
+  // Nor does it need which accounts the deck signed in (#1893): the roster
+  // carries what a row needs, and the map is the deck's own bookkeeping.
+  const { report: _report, accounts: _accounts, ...p } = normalise(prefs);
   // unpaired is engine-authored state too. No page draws or edits it; keeping
   // it out also means a future whole-prefs form cannot replay a stale unpair
   // list over a decision the engine made after the form loaded.

package/src/server/feedback-form.mjs

@@ -0,0 +1,125 @@
+// A report with images (#1853's dialog): the multipart form the page posts,
+// read and checked here, and the one this server sends on to api.ccdeck.dev.
+//
+// THE API'S LIMITS ARE HELD HERE FIRST, so a request it would refuse never
+// leaves the machine: at most three images, each at most 5 MB, the whole
+// request at most 12 MB, and each a PNG or a JPEG as its first bytes say —
+// never as its name or the type the page declared, since a GIF renamed .png is
+// still a GIF (ccdeck-api FeedbackForm and ImageScrub, which this mirrors).
+// What the API checks and this does not is the image's inside: each side 1 to
+// 8192 pixels, and a PNG or JPEG that is whole. The dialog fits the sides
+// before sending, and a damaged file comes back as the API's own 400.
+//
+// WHAT GOES ON is the page's text as it came, this deck's version and system
+// from feedbackFacts (the page's own are ignored, as they are for JSON), and
+// each image's bytes under a name of this server's making. A file's own name
+// can say whose machine it was on — "alice-desk.png" — and the API keeps no
+// name, so none is sent. The API strips EXIF, GPS and text chunks itself.
+//
+// Node's own Request parses the form and its FormData builds the next one, so
+// this costs no dependency. Both are there on the Node 18 the package promises
+// (undici's multipart reader shipped inside it); `File` is not a global before
+// Node 20 and is never named here.
+
+export const IMAGES_FIELD = "images";
+export const MAX_IMAGES = 3;
+export const MAX_IMAGE_BYTES = 5 * 1024 * 1024;
+/** The whole request, images and text together. Three images at their limit do not fit, on purpose. */
+export const MAX_REQUEST_BYTES = 12 * 1024 * 1024;
+
+const PNG_SIGNATURE = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
+const JPEG_START = [0xff, 0xd8, 0xff];
+const TEXT_FIELDS = ["kind", "title", "body", "contact"];
+
+/** What a file is by its first bytes: "png", "jpeg", or null for anything else. */
+export function imageFormat(bytes) {
+  const starts = sig => sig.every((b, i) => bytes[i] === b);
+  if (bytes.length >= PNG_SIGNATURE.length && starts(PNG_SIGNATURE)) return "png";
+  if (bytes.length >= JPEG_START.length && starts(JPEG_START)) return "jpeg";
+  return null;
+}
+
+const FORMAT = {
+  png: { type: "image/png", extension: "png" },
+  jpeg: { type: "image/jpeg", extension: "jpg" },
+};
+
+/** Whether a request's content type says it is a multipart form. */
+export function isMultipart(contentType) {
+  return typeof contentType === "string" && /^multipart\/form-data\s*;/i.test(contentType.trim());
+}
+
+/**
+ * The page's form, read: its text fields and its images, each image known by
+ * its bytes. `problems` holds one sentence per thing the API would refuse, in
+ * the API's own words, and is empty when the form may go on. Null when the
+ * body is not a form at all.
+ */
+export async function readFeedbackForm(bytes, contentType) {
+  let form;
+  try {
+    form = await new Request("http://127.0.0.1/", {
+      method: "POST",
+      headers: { "content-type": contentType },
+      body: bytes,
+    }).formData();
+  } catch {
+    return null;
+  }
+
+  const problems = [];
+  const fields = {};
+  const files = [];
+  let fileElsewhere = false;
+  let imageAsText = false;
+  for (const [name, value] of form.entries()) {
+    const isFile = typeof value !== "string";
+    if (name === IMAGES_FIELD) {
+      if (isFile) files.push(value);
+      else imageAsText = true;
+    } else if (isFile) {
+      fileElsewhere = true;
+    } else if (TEXT_FIELDS.includes(name) && !(name in fields)) {
+      fields[name] = value;
+    }
+  }
+  // Refused rather than ignored, as the API does: a part named "image" would
+  // otherwise leave its sender believing the screenshot arrived.
+  if (fileElsewhere) problems.push("Only parts named images may carry a file.");
+  if (imageAsText) problems.push("Send each image as a file part.");
+
+  const images = [];
+  if (files.length > MAX_IMAGES) {
+    problems.push(`At most ${MAX_IMAGES} images.`);
+  } else {
+    for (const [index, file] of files.entries()) {
+      const n = index + 1;
+      if (file.size > MAX_IMAGE_BYTES) {
+        problems.push(`Image ${n} is over ${MAX_IMAGE_BYTES / 1024 / 1024} MB.`);
+        continue;
+      }
+      const data = new Uint8Array(await file.arrayBuffer());
+      const format = imageFormat(data);
+      if (!format) problems.push(`Image ${n} is not a PNG or a JPEG.`);
+      else images.push({ data, format });
+    }
+  }
+  return { fields, images, problems };
+}
+
+/** The form this server posts on: the page's text, this deck's facts (feedbackFacts in reports-routes.mjs), and the images under names of its own. */
+export function upstreamForm({ fields, images }, facts) {
+  const form = new FormData();
+  for (const name of ["kind", "title", "body"]) {
+    if (typeof fields[name] === "string") form.append(name, fields[name]);
+  }
+  const contact = typeof fields.contact === "string" ? fields.contact.trim() : "";
+  if (contact) form.append("contact", contact);
+  form.append("appVersion", facts.appVersion);
+  form.append("platform", facts.platform);
+  for (const [index, { data, format }] of images.entries()) {
+    const { type, extension } = FORMAT[format];
+    form.append(IMAGES_FIELD, new Blob([data], { type }), `image-${index + 1}.${extension}`);
+  }
+  return form;
+}

package/src/server/http-io.mjs

@@ -74,10 +74,7 @@ export function readBody(req, res = null, limit = 64_000) {
         refused = true;
         body = "";
         if (res) send(res, 413, { error: "body too large" });
-        req.resume();
-        const grace = setTimeout(() => req.destroy(), OVERSIZE_DRAIN_MS);
-        grace.unref?.();
-        req.on("close", () => clearTimeout(grace));
+        drainRefused(req);
         reject(new Error("body too large"));
       }
     });
@@ -86,6 +83,45 @@ export function readBody(req, res = null, limit = 64_000) {
   });
 }
 
+/** Keep reading a refused upload and throw it away, for a bounded while — see readBody. */
+function drainRefused(req) {
+  req.resume();
+  const grace = setTimeout(() => req.destroy(), OVERSIZE_DRAIN_MS);
+  grace.unref?.();
+  req.on("close", () => clearTimeout(grace));
+}
+
+/**
+ * readBody for a body that is bytes rather than text: the feedback dialog's
+ * multipart form, whose images a utf8 decode would corrupt. The same cap in
+ * bytes, the same 413 on the wire before the hang-up and the same bounded
+ * drain. `refusal` is what the 413 says, so a page that reads a `reason` off
+ * the answer is given one.
+ */
+export function readBytes(req, res = null, limit = 64_000, refusal = { error: "body too large" }) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    let refused = false;
+    req.on("data", c => {
+      if (refused) return;
+      const chunk = typeof c === "string" ? Buffer.from(c) : c;
+      size += chunk.length;
+      if (size > limit) {
+        refused = true;
+        chunks.length = 0;
+        if (res) send(res, 413, refusal);
+        drainRefused(req);
+        reject(new Error("body too large"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => { if (!refused) resolve(Buffer.concat(chunks, size)); });
+    req.on("error", reject);
+  });
+}
+
 // A request handler rejected. Two audiences, two different amounts of detail:
 // the operator, who needs the whole error — stack included — to find the bug,
 // and the HTTP client, which needs to know only that the request failed.

package/src/server/index.mjs

@@ -137,7 +137,7 @@ import { handleLanInvite, handleLanPeer, handleLanStatus, handleLanSync } from "
 import { handlePrefsGiveBack, handlePrefsRead, handlePrefsWrite } from "./prefs-routes.mjs";
 // Usage reports and the feedback dialog (#1853). The requests to
 // api.ccdeck.dev are made in reports.mjs, never in this file.
-import { handleClientError, handleFeedback, handleReportsWrite } from "./reports-routes.mjs";
+import { handleClientError, handleFeedback, handleFeedbackFacts, handleReportsWrite } from "./reports-routes.mjs";
 import { reporter } from "./reports.mjs";
 import { MANIFEST_PATH, offerManifest } from "./app-manifest.mjs";
 import { historySnapshot, processesReply, readProcesses, startSystemMetrics, systemSnapshot } from "./system-metrics.mjs";
@@ -148,7 +148,7 @@ import { send, sendInternalError } from "./http-io.mjs";
 export { sendInternalError };
 // The accounts surface's routes — see account-routes.mjs. The boot wires the
 // stale-copy repair and starts auto-switch through the same module.
-import { cswapAutoModule, getProjectRollup, handleAccountLoginState, handleAccountProjects, handleClaudeAccountAdmin, handleClaudeAccountSwitch, handleClaudeAccounts, handleCswapAuto, handleCswapAutoAction, wireStaleCopyRepair } from "./account-routes.mjs";
+import { cswapAutoModule, getProjectRollup, handleAccountLoginState, handleAccountProjects, handleClaudeAccountAdmin, handleClaudeAccountSwitch, handleClaudeAccounts, handleCswapAuto, handleCswapAutoAction, wireAccountOrigins, wireStaleCopyRepair } from "./account-routes.mjs";
 // Browser Watch's three routes — see browser-watch-routes.mjs.
 import { handleBrowserWatch, handleBrowserWatchDismiss, handleBrowserWatchSettings } from "./browser-watch-routes.mjs";
 // The music routes, every one behind AGENTS_DECK_NO_MUSIC — see music-routes.mjs.
@@ -191,7 +191,12 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
   // The repair a paused Claude account used to wait on a `resume` press for:
   // handed to the roster read here, by the server that is actually running,
   // rather than wired at import — see wireStaleCopyRepair.
-  if (deckProviders().claude) wireStaleCopyRepair();
+  if (deckProviders().claude) {
+    wireStaleCopyRepair();
+    // Which accounts the deck signed in, and the prompt for one whose login
+    // has stopped working (#1893).
+    wireAccountOrigins();
+  }
   const removed = await sweepStaleDiscovery();
   if (removed > 0) console.log(`  swept ${removed} stale discovery file(s)`);
   // Where the log is and whether it can be written, asked before the first
@@ -307,6 +312,7 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
     if (req.method === "POST" && url.pathname === "/api/prefs")        return guard(handlePrefsWrite(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/prefs/give-back") return guard(handlePrefsGiveBack(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/reports")      return guard(handleReportsWrite(req, res), res);
+    if (req.method === "GET"  && url.pathname === "/api/feedback")     return handleFeedbackFacts(req, res);
     if (req.method === "POST" && url.pathname === "/api/feedback")     return guard(handleFeedback(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/client-error") return guard(handleClientError(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/system")       return send(res, 200, systemSnapshot());

package/src/server/prefs-routes.mjs

@@ -55,7 +55,10 @@ export async function handlePrefsWrite(req, res) {
   // The reports switch has consequences a plain write would skip — a deletion
   // asked for — so it is changed only through /api/reports, and its state never
   // by the page at all (#1853).
-  const { reports: _reports, report: _report, ...patch } = body;
+  // Which accounts the deck signed in is the deck's to record, on a sign-in it
+  // ran itself (#1893); a page that could write it could give any account a
+  // provenance it never had.
+  const { reports: _reports, report: _report, accounts: _accounts, ...patch } = body;
   try {
     await heldPrefs.write(patch);
   } catch (err) {

package/src/server/reports-routes.mjs

@@ -4,7 +4,8 @@
 // install id never has to reach the page.
 
 import { reportsVetoed } from "./deck-prefs.mjs";
-import { readBody, send } from "./http-io.mjs";
+import { MAX_REQUEST_BYTES, isMultipart, readFeedbackForm, upstreamForm } from "./feedback-form.mjs";
+import { readBody, readBytes, send } from "./http-io.mjs";
 import { heldPrefs } from "./prefs-state.mjs";
 import { REPORTS_API, installFacts, reporter } from "./reports.mjs";
 
@@ -39,9 +40,13 @@ export async function handleClientError(req, res, { report = reporter } = {}) {
  * `POST /api/feedback` `{ kind, title, body, contact? }`: the feedback dialog.
  *
  * The API stores it, and the people who make ccdeck read it there. They may
- * open a public issue from it, never with the contact; nothing becomes public
- * by being sent, which is why the answer to the page is a plain "it arrived"
- * and carries no link.
+ * open a public issue from it, never with the contact or the images; nothing
+ * becomes public by being sent, which is why the answer to the page is a plain
+ * "it arrived" and carries no link.
+ *
+ * A report with images comes as a multipart form instead, and goes on as one —
+ * see feedback-form.mjs for what is checked here before it leaves. With none it
+ * is the JSON post it always was.
  *
  * Not gated on the reports switch: pressing Send is its own decision, for this
  * one message. AGENTS_DECK_NO_INSTALL=1 still wins, because the README promises
@@ -50,23 +55,76 @@ export async function handleClientError(req, res, { report = reporter } = {}) {
  */
 export async function handleFeedback(req, res, { fetchImpl = globalThis.fetch, env = process.env } = {}) {
   if (env.AGENTS_DECK_NO_INSTALL === "1") return send(res, 403, { ok: false, reason: "vetoed" });
+  const contentType = req.headers?.["content-type"];
+  if (isMultipart(contentType)) return forwardFeedbackForm(req, res, contentType, { fetchImpl, env });
   const body = await readJson(req, res, 32_000);
   if (!body) return send(res, 400, { ok: false, reason: "bad_request" });
-  const facts = installFacts({ env });
+  const facts = feedbackFacts({ env });
   const contact = typeof body.contact === "string" && body.contact.trim() ? body.contact.trim() : undefined;
+  return forwardFeedback(res, fetchImpl, {
+    headers: { "content-type": "application/json", "user-agent": `ccdeck/${facts.appVersion}` },
+    body: JSON.stringify({ kind: body.kind, title: body.title, body: body.body, contact, ...facts }),
+    timeoutMs: JSON_TIMEOUT_MS,
+  });
+}
+
+/**
+ * What this deck adds to a piece of feedback, and all it adds: the ccdeck
+ * version, and the system as `os-arch` — `darwin-arm64`. installFacts knows
+ * more than that (the channel, the runtime, a locale, a device fingerprint)
+ * and none of it goes with feedback. One function for both posts and for the
+ * line the dialog draws before Send, so what the page says is sent and what
+ * the API is sent are one answer and cannot drift apart.
+ */
+export function feedbackFacts({ env = process.env } = {}) {
+  const facts = installFacts({ env });
+  return { appVersion: facts.version, platform: `${facts.os}-${facts.arch}` };
+}
+
+/** `GET /api/feedback`: what a report sent from here would carry besides its
+ *  words, for the dialog to say before Send. Nothing leaves the machine. */
+export function handleFeedbackFacts(_req, res, { env = process.env } = {}) {
+  return send(res, 200, { ok: true, ...feedbackFacts({ env }) });
+}
+
+/** Twenty seconds is plenty for a few kilobytes of JSON. */
+const JSON_TIMEOUT_MS = 20_000;
+/** And not for 12 MB: at 2 Mbit/s up, a line a hotel can offer, that is fifty
+ *  seconds of upload before the API has read a byte of it. */
+const FORM_TIMEOUT_MS = 120_000;
+
+async function forwardFeedbackForm(req, res, contentType, { fetchImpl, env }) {
+  // Over the cap, readBytes has already answered 413 too_large and the 400
+  // below is a no-op; this is the answer to a read that failed some other way.
+  const bytes = await readBytes(req, res, MAX_REQUEST_BYTES, { ok: false, reason: "too_large" }).catch(() => null);
+  if (!bytes) return send(res, 400, { ok: false, reason: "bad_request" });
+  const form = await readFeedbackForm(bytes, contentType);
+  if (!form) return send(res, 400, { ok: false, reason: "bad_request" });
+  if (form.problems.length > 0) return send(res, 400, { ok: false, reason: "invalid", errors: { images: form.problems } });
+  const facts = feedbackFacts({ env });
+  return forwardFeedback(res, fetchImpl, {
+    // No content type: fetch writes the form's own, boundary and all.
+    headers: { "user-agent": `ccdeck/${facts.appVersion}` },
+    body: upstreamForm(form, facts),
+    timeoutMs: FORM_TIMEOUT_MS,
+  });
+}
+
+/** One post to the API, JSON or form, and what its answer means for the page. */
+async function forwardFeedback(res, fetchImpl, { headers, body, timeoutMs }) {
   try {
     const upstream = await fetchImpl(`${REPORTS_API}/v1/feedback`, {
       method: "POST",
-      headers: { "content-type": "application/json", "user-agent": `ccdeck/${facts.version}` },
-      body: JSON.stringify({
-        kind: body.kind, title: body.title, body: body.body, contact,
-        appVersion: facts.version, platform: `${facts.os}-${facts.arch}`,
-      }),
-      signal: AbortSignal.timeout(20_000),
+      headers,
+      body,
+      signal: AbortSignal.timeout(timeoutMs),
     });
     const answer = await upstream.json().catch(() => null);
     if (upstream.status === 202) return send(res, 200, { ok: true });
     if (upstream.status === 400) return send(res, 400, { ok: false, reason: "invalid", errors: answer?.errors ?? {} });
+    // Its own reason rather than "unavailable": the API is up, and the fix is
+    // a smaller request, which is not what "try again in a moment" says.
+    if (upstream.status === 413) return send(res, 413, { ok: false, reason: "too_large" });
     if (upstream.status === 429) return send(res, 429, { ok: false, reason: "too_many" });
     return send(res, 502, { ok: false, reason: "unavailable" });
   } catch {

package/src/server/static-serve.mjs

@@ -29,6 +29,7 @@ const MIME = {
   // with nothing in the console that names the reason.
   ".webmanifest": "application/manifest+json; charset=utf-8",
   ".png":  "image/png",
+  ".ico":  "image/x-icon",
   ".jpg":  "image/jpeg",
   ".woff2": "font/woff2",
   ".map":  "application/json",