ccdeck 3.36.1 → 3.36.4

package/dist/web/index.html

@@ -64,8 +64,8 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-D09Vu58F.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-1U-Iz_x2.css">
+    <script type="module" crossorigin src="/assets/index-Cb31GACQ.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BkXTN4dZ.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.36.1",
+  "version": "3.36.4",
   "description": "Local dashboard for Claude Code and Codex CLI sessions: which Claude Code session needs input, every tool call and Claude Code subagent live, token cost and quota, several Claude accounts. Run npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -62,7 +62,14 @@
     "3.35.0",
     "3.35.1",
     "3.36.0",
-    "3.36.1"
+    "3.36.1",
+    "3.36.4"
+  ],
+  "3.36.3": [
+    {
+      "title": "🔑 An expired login asks to be signed in again",
+      "body": "When an account you added with + → Sign in stops working, the deck now tells you in one dialog, with every affected account together and Sign in again beside each. That opens the usual sign-in with the address already filled in, and the account keeps its slot, its alias and its history. Not now leaves it marked in the Accounts panel and does not ask again until it has worked and stopped again. A paired deck holding a working copy gets to repair it first, and accounts that came from a share or Local network are never asked about."
+    }
   ],
   "3.34.1": [
     {

package/src/server/deck-prefs.mjs

@@ -80,8 +80,8 @@ export const DEFAULTS = Object.freeze({
   // the server can read it with no page open.
   autoUpdate: true,
   // USAGE REPORTS (#1853), ON unless somebody turns them off — the owner's
-  // decision, 2026-09-30: nobody is asked, the README says what is sent, and
-  // Appearance holds the switch. See reports.mjs for what is sent, and
+  // decision, 2026-09-30: nobody is asked and the README says what is sent; the
+  // page has no switch since 2026-10-01. See reports.mjs for what is sent, and
   // reportsVetoed for the launch-time veto that wins over this.
   reports: true,
   // What reports.mjs keeps between runs, and the page never sees

package/src/server/reports-routes.mjs

@@ -1,5 +1,5 @@
-// The page's three ways into reports.mjs (#1853): the switch in Appearance, an
-// error the page caught, and the feedback dialog. The page never
+// The page's ways into reports.mjs (#1853): an error the page caught and the
+// feedback dialog. (The switch in Appearance went on 2026-10-01; its route stays.) The page never
 // talks to api.ccdeck.dev itself — this server does, which is also why the
 // install id never has to reach the page.
 
@@ -19,7 +19,8 @@ async function readJson(req, res, limit) {
   }
 }
 
-/** `POST /api/reports` `{ on }`: Appearance's "Send usage reports" switch. */
+/** `POST /api/reports` `{ on }`: sets `prefs.reports`. No page control calls it since the owner
+ *  removed Appearance's switch (2026-10-01); kept so a deck can still be switched off over the API. */
 export async function handleReportsWrite(req, res, { report = reporter } = {}) {
   const body = await readJson(req, res, 1_000);
   if (typeof body?.on !== "boolean") return send(res, 400, { ok: false, reason: "bad_request" });

package/src/server/reports.mjs

@@ -40,8 +40,9 @@
 // so it stops entirely the moment reports are switched off or vetoed.
 //
 // NOBODY IS ASKED, AND NOTHING IS HIDDEN. The owner chose on-by-default
-// (2026-09-30): the README says what is sent, Appearance holds the switch, and
-// AGENTS_DECK_NO_REPORTS=1 keeps it off from the first start.
+// (2026-09-30): the README says what is sent, and AGENTS_DECK_NO_REPORTS=1 keeps it
+// off from the first start. The deck has no switch for it since the owner removed
+// Appearance's on 2026-10-01.
 //
 // SWITCHING IT OFF DELETES WHAT WAS SENT. The id is forgotten here and the API
 // is asked to drop every event and error it holds for it; if that request