ccdeck 3.36.9 → 3.37.0

package/src/server/event-log.mjs

@@ -147,6 +147,8 @@ export async function logSharing() {
 const ROTATE_AT_BYTES = 50 * 1024 * 1024;
 let lastRotateCheckAt = 0;
 let rotateInProgress = false;
+/** The idle look's timer, armed once by openEventLog. */
+let rotateTimer = null;
 /** Bytes handed to appendLogLine since the last time we looked at the file.
  *
  *  THE 30-SECOND CLOCK MADE THE THRESHOLD ADVISORY. The stat was throttled to
@@ -320,6 +322,19 @@ async function openEventLog(persist) {
   // Taken the moment the probe answers, so that a line landing from here on
   // is evidence newer than it. See logWritableNow.
   _landedAtProbe = appendsLanded(persistPath);
+  // THE IDLE FLOOR, RUN. ROTATE_CHECK_EVERY_MS was described as the look that
+  // notices "another deck appending to a log they share", and the push path
+  // was its one caller — so the deck that owns a log and writes nothing to it,
+  // a scoped deck on a quiet tree beside a machine-wide one, never looked, and
+  // the deck appending every line was not the owner and returned at the
+  // ownership gate. The file grew past the cap for as long as both ran. A
+  // timer makes the owner look whether or not it writes; the gate and
+  // `rotateInProgress` already make a look from here safe. One per process,
+  // and it never holds the process open.
+  if (!rotateTimer) {
+    rotateTimer = setInterval(() => { maybeRotatePersistFile(0); }, ROTATE_CHECK_EVERY_MS);
+    rotateTimer.unref?.();
+  }
 }
 
 // What index.mjs calls besides the three exported above. Listed rather than

package/src/server/event-pipeline.mjs

@@ -88,9 +88,12 @@ export function pushEvent(raw, source, opts = {}) {
   raw = redactDeckToken(raw);
 
   // Synchronous enrichment: if we already know this session's model, stamp
-  // it on the payload so the client's recursive scanner picks it up.
+  // it on the payload so the client's recursive scanner picks it up — the
+  // subagent's own model on a subagent's own event, never the root's. See
+  // knownModelId.
   if (raw && typeof raw === "object" && raw.session_id && !raw.model) {
-    const modelId = knownModelId(raw.session_id);
+    const subagentKey = [raw.agent_id, raw.parent_tool_use_id].find(k => typeof k === "string" && k) ?? null;
+    const modelId = knownModelId(raw.session_id, subagentKey);
     if (modelId) raw.model = modelId;
   }
 

package/src/server/event-routes.mjs

@@ -18,6 +18,10 @@ import { SEQ_EPOCH, ringHoldsNewerThan, ringSnapshot } from "./event-ring.mjs";
 // The one door every event comes through — see event-pipeline.mjs.
 import { pushEvent } from "./event-pipeline.mjs";
 import { noteLogWriter } from "./event-log.mjs";
+// Which CLIs this deck watches — see deck-scope.mjs.
+import { deckProviders } from "./deck-scope.mjs";
+// The names only the server may send — see ring-bounds.mjs.
+import { isReservedEventName } from "./ring-bounds.mjs";
 // The SSE subscribers and the backpressure every frame to them is written
 // under — see sse-clients.mjs.
 import { dropSse, sseClients, trayClients, writeResume, writeSse } from "./sse-clients.mjs";
@@ -176,6 +180,24 @@ export function handleEventIngest(req, res, persist = true) {
     let parsed;
     try { parsed = JSON.parse(body); }
     catch { return send(res, 400, { error: "invalid json" }); }
+    // Names beginning `__` are the deck's own control markers — `__clear` is
+    // the one handleClear sends — and only the server may send them. This is
+    // the one mutating route open without the deck's token, so a reserved name
+    // arriving here is refused before it can reach the ring, the pages or the
+    // log. No hook event is named that way.
+    if (isReservedEventName(parsed?.hook_event_name)) {
+      return send(res, 400, { error: "reserved event name" });
+    }
+    // A deck started with --no-claude takes no Claude hook event, which is what
+    // its replay already decides (see replayScope) and what a current hook no
+    // longer sends it. A hook installed before that still does, so the refusal
+    // is an answer rather than a silent drop: a hook that elected this deck to
+    // write the log hands it on to the next deck instead of losing the line.
+    // Read off the provider every Claude hook has stamped since Codex support
+    // arrived, so it is the payload saying whose it is.
+    if (!deckProviders().claude && parsed?.provider === "claude") {
+      return send(res, 409, { error: "this deck is not watching Claude" });
+    }
     // Everything past the parse is inside one net, because this listener is the
     // one place in the route table `guard` cannot reach. The route does wrap the
     // call — `guard(handleEventIngest(req, res, …), res)` — but this function

package/src/server/feedback-form.mjs

@@ -16,10 +16,12 @@
 // can say whose machine it was on — "alice-desk.png" — and the API keeps no
 // name, so none is sent. The API strips EXIF, GPS and text chunks itself.
 //
-// Node's own Request parses the form and its FormData builds the next one, so
-// this costs no dependency. Both are there on the Node 18 the package promises
-// (undici's multipart reader shipped inside it); `File` is not a global before
-// Node 20 and is never named here.
+// Node's own Request parses the form and the next one is written out by hand
+// (upstreamForm says why), so this costs no dependency. Request is there on the
+// Node 18 the package promises (undici's multipart reader shipped inside it);
+// `File` is not a global before Node 20 and is never named here.
+
+import { randomBytes } from "node:crypto";
 
 export const IMAGES_FIELD = "images";
 export const MAX_IMAGES = 3;
@@ -80,7 +82,9 @@ export async function readFeedbackForm(bytes, contentType) {
     } else if (isFile) {
       fileElsewhere = true;
     } else if (TEXT_FIELDS.includes(name) && !(name in fields)) {
-      fields[name] = value;
+      // Back to the LF the box held. A textarea's value never has a CR in it,
+      // so every CRLF here is the form encoding's, not the person's.
+      fields[name] = value.replace(/\r\n/g, "\n");
     }
   }
   // Refused rather than ignored, as the API does: a part named "image" would
@@ -107,19 +111,38 @@ export async function readFeedbackForm(bytes, contentType) {
   return { fields, images, problems };
 }
 
-/** The form this server posts on: the page's text, this deck's facts (feedbackFacts in reports-routes.mjs), and the images under names of its own. */
+/**
+ * The form this server posts on: the page's text, this deck's facts
+ * (feedbackFacts in reports-routes.mjs), and the images under names of its own.
+ *
+ * WRITTEN OUT HERE rather than through FormData, for the line breaks. A form's
+ * encoding turns every line break in a text field into CRLF, FormData's too,
+ * and the API counts a CRLF as two characters of the message's 10,000. A pasted
+ * log of a thousand short lines that fitted the box went over with an image
+ * attached, while the same words went through as JSON without one. So the text
+ * goes on as the box held it, LF for LF, and the limit means the same on both
+ * paths.
+ *
+ * A Blob whose type carries the boundary, so fetch still writes the content
+ * type itself. The boundary is lower case because a Blob's type is, and random
+ * so no message can contain it.
+ */
 export function upstreamForm({ fields, images }, facts) {
-  const form = new FormData();
+  const boundary = `ccdeck-${randomBytes(16).toString("hex")}`;
+  const parts = [];
+  const head = (name, file = "") => `--${boundary}\r\nContent-Disposition: form-data; name="${name}"${file}\r\n`;
+  const text = (name, value) => parts.push(`${head(name)}\r\n${value}\r\n`);
   for (const name of ["kind", "title", "body"]) {
-    if (typeof fields[name] === "string") form.append(name, fields[name]);
+    if (typeof fields[name] === "string") text(name, fields[name]);
   }
   const contact = typeof fields.contact === "string" ? fields.contact.trim() : "";
-  if (contact) form.append("contact", contact);
-  form.append("appVersion", facts.appVersion);
-  form.append("platform", facts.platform);
+  if (contact) text("contact", contact);
+  text("appVersion", facts.appVersion);
+  text("platform", facts.platform);
   for (const [index, { data, format }] of images.entries()) {
     const { type, extension } = FORMAT[format];
-    form.append(IMAGES_FIELD, new Blob([data], { type }), `image-${index + 1}.${extension}`);
+    parts.push(`${head(IMAGES_FIELD, `; filename="image-${index + 1}.${extension}"`)}Content-Type: ${type}\r\n\r\n`, data, "\r\n");
   }
-  return form;
+  parts.push(`--${boundary}--\r\n`);
+  return new Blob(parts, { type: `multipart/form-data; boundary=${boundary}` });
 }

package/src/server/index.mjs

@@ -139,7 +139,9 @@ import { handleLanInvite, handleLanPeer, handleLanStatus, handleLanSync } from "
 import { handlePrefsGiveBack, handlePrefsRead, handlePrefsWrite } from "./prefs-routes.mjs";
 // Usage reports and the feedback dialog (#1853). The requests to
 // api.ccdeck.dev are made in reports.mjs, never in this file.
-import { handleClientError, handleFeedback, handleFeedbackFacts, handleReportsWrite } from "./reports-routes.mjs";
+import {
+  handleClientError, handleFeedback, handleFeedbackFacts, handleRatingRead, handleRatingWrite, handleReportsWrite,
+} from "./reports-routes.mjs";
 import { reporter } from "./reports.mjs";
 import { MANIFEST_PATH, offerManifest } from "./app-manifest.mjs";
 import { historySnapshot, processesReply, readProcesses, startSystemMetrics, systemSnapshot } from "./system-metrics.mjs";
@@ -182,7 +184,7 @@ export function requestUrl(rawUrl) {
 }
 
 export async function startServer({ port = 4317, host = "127.0.0.1", persist = null, portRange = [4318, 4400], workspace = "", codex = true, claude = true, onRestart = null, onStop = null, cswapQuiet = null } = {}) {
-  armLifecycle({ onRestart, onStop, persist });
+  armLifecycle({ onRestart, onStop, persist, onSelfUpdate: () => reporter.noteSelfUpdate() });
   // Which tree and which CLIs, normalised once — see setDeckScope.
   setDeckScope({ workspace, claude, codex });
   // A boot is the one moment the file, and not the engine, is the authority on
@@ -322,6 +324,8 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
     if (req.method === "GET"  && url.pathname === "/api/feedback")     return handleFeedbackFacts(req, res);
     if (req.method === "POST" && url.pathname === "/api/feedback")     return guard(handleFeedback(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/client-error") return guard(handleClientError(req, res), res);
+    if (req.method === "GET"  && url.pathname === "/api/rating")       return handleRatingRead(req, res);
+    if (req.method === "POST" && url.pathname === "/api/rating")       return guard(handleRatingWrite(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/system")       return send(res, 200, systemSnapshot());
     // On demand only — the process list costs a subprocess on every platform,
     // so it is fetched while the detail panel is open and never on the timer.

package/src/server/install-layout.mjs

@@ -67,6 +67,41 @@ export function isNpxInstall(pkgRoot) {
   return typeof pkgRoot === "string" && pkgRoot.split(/[\\/]/).includes("_npx");
 }
 
+/** Any one-off runner's copy: npx's, and the three that are not npm's —
+ *
+ *    pnpm dlx   <cache>/pnpm/dlx/<hash>/…, and dlx-<pid>/ in a temp folder before pnpm cached them
+ *    bunx       <tmp>/bunx-<uid>-<spec>/, cleared at reboot
+ *    yarn dlx   <tmp>/xfs-<id>/dlx-<pid>/
+ *
+ *  Only `_npx` used to be recognised, so the other three looked like a global
+ *  install: the first start wrote a login item naming a file inside the cache,
+ *  and the writable folder made the update an `npm i -g` the away-update ran by
+ *  itself, every thirty minutes, without ever moving the running copy. Neither
+ *  has a path anybody promised to keep. Segment-wise and separator-agnostic,
+ *  for the reasons isNpxInstall gives. */
+export function isOneOffRun(pkgRoot) {
+  return oneOffRunner(pkgRoot) !== null;
+}
+
+/** Which of those four unpacked this copy — "npx", "pnpm dlx", "bunx" or
+ *  "yarn dlx" — or null for a copy that stays. None of them leaves the
+ *  package's command on PATH, so a command this deck tells somebody to type
+ *  goes through the runner they used. yarn's `dlx-<pid>` sits in an `xfs-`
+ *  folder; pnpm's, from before it cached them, does not. */
+export function oneOffRunner(pkgRoot) {
+  if (typeof pkgRoot !== "string") return null;
+  if (isNpxInstall(pkgRoot)) return "npx";
+  // `dlx` alone only under pnpm's cache directory (pnpm/, pnpm-cache/), so a
+  // project folder that happens to be called that is not taken for one.
+  const parts = pkgRoot.split(/[\\/]/);
+  for (const [i, p] of parts.entries()) {
+    if (p === "dlx" && /pnpm/i.test(parts[i - 1] ?? "")) return "pnpm dlx";
+    if (/^bunx-\d+-/.test(p)) return "bunx";
+    if (/^dlx-\d+$/.test(p)) return /^xfs-/.test(parts[i - 1] ?? "") ? "yarn dlx" : "pnpm dlx";
+  }
+  return null;
+}
+
 /** A git checkout is the maintainer's own tree. Its version routinely sits
  *  ahead of npm, and telling someone to `npm i -g` over their working copy is
  *  actively wrong, so the registry side of the check is skipped there.

package/src/server/install-ref.mjs

@@ -0,0 +1,39 @@
+// Which page of ccdeck.dev an install came from — the `--ref` its command
+// carried, for the usage reports (reports.mjs).
+//
+// WHAT IT ANSWERS. The site offers a command to copy on most of its pages, and
+// puts a ref naming the page in it: `npx ccdeck --ref=guides-first-run`. The
+// first "install" report carries that ref, and nothing else ever does, so the
+// people who make ccdeck can tell which page a new install came from rather than
+// guess it from site visits. A ref names a page of the site and nothing about the
+// person: lowercase letters, digits and dashes, at most REF_MAX of them, and
+// anything else is dropped here rather than sent.
+//
+// ONCE. A ref on any later run — a reinstall over an install that already
+// reported, a respawn whose argv still carries it — is ignored: only the install
+// it arrived with is new. If that install's report cannot get out, the ref waits
+// in the prefs beside the install id and goes with the next try, then is cleared.
+//
+// The boot (bin/deck.js) is what reads the command line, and it reaches this
+// module through noteRef. This file imports nothing, so the boot and the prefs
+// can both load it early.
+
+/** The longest ref. The API takes the same. */
+export const REF_MAX = 32;
+
+/** The ref if it is one, else undefined. */
+export function refSlug(raw) {
+  return typeof raw === "string" && raw.length <= REF_MAX && /^[a-z0-9-]+$/.test(raw) ? raw : undefined;
+}
+
+let noted;
+
+/** What this run's command line said, if it said anything that is a ref. */
+export function noteRef(raw) {
+  noted = refSlug(raw);
+}
+
+/** This run's ref, or undefined. */
+export function notedRef() {
+  return noted;
+}

package/src/server/installer.mjs

@@ -81,7 +81,8 @@ const LEGACY_DIRS = ["ccgraph", "agent-flow", "agent-dag"];
  * It used to wrap both paths in double quotes, which on POSIX escapes nothing:
  * `$(…)`, a backtick and `\` are all still live inside them. Both paths come
  * from outside — `installedHookPath` is built from $CLAUDE_CONFIG_DIR (resolved,
- * never validated) or homedir(), and `node` is process.execPath — so a config
+ * never validated) or homedir(), and `node` is process.execPath or the PATH
+ * entry that links to it (stable-node.mjs) — so a config
  * dir called `/tmp/a$(id)b` was shell code, written into the user's own settings
  * file and executed on every hook fire for as long as it stayed there. The
  * quieter half of the same bug cost nothing but the feature: an ordinary `$` in
@@ -99,11 +100,28 @@ const LEGACY_DIRS = ["ccgraph", "agent-flow", "agent-dag"];
  * double quotes), so without the second parameter the only assertion a test can
  * make is the one its own OS happens to produce, which is how this went five
  * releases with the Windows half of it never once executed.
+ *
+ * WHEN THE NODE IT NAMES IS GONE. stable-node.mjs finds a spelling of the node
+ * that outlives an upgrade where there is one, and nvm, fnm and Volta have
+ * none: the command named ~/.nvm/versions/node/<v>/bin/node, `nvm uninstall`
+ * took it away, and every tool call of every session showed a hook error from
+ * then on. So on POSIX the arguments go to a fixed /bin/sh script that runs the
+ * recorded node while it is executable, the node on Claude Code's own PATH once
+ * it is not, and nothing when there is no node at all — exit 0 and no output,
+ * which Claude Code does not report. The script is a constant and the paths
+ * reach it as positional arguments, quoted once by the same escaper, so none of
+ * them is ever spliced into shell code; and it is /bin/sh by its path, the
+ * shell Claude Code itself runs the line with, so neither a PATH without it
+ * nor a login shell that is not POSIX changes what the script means. The cost
+ * is one `sh` exec before node's own start. Windows keeps the direct command.
  */
+const NODE_FALLBACK = 'n=$1; shift; [ -x "$n" ] || n=$(command -v node) || exit 0; exec "$n" "$@"';
+
 export function hookCommand(installedHookPath, provider, node = process.execPath,
                             platform = process.platform) {
   const q = (s) => shellQuoteArg(s, platform);
-  return `${q(node)} ${q(installedHookPath)} --provider ${q(provider)}`;
+  const args = `${q(node)} ${q(installedHookPath)} --provider ${q(provider)}`;
+  return platform === "win32" ? args : `/bin/sh -c ${q(NODE_FALLBACK)} ccdeck-hook ${args}`;
 }
 
 function isMarked(g) {

package/src/server/lan-beacon.mjs

@@ -13,8 +13,9 @@ import dgram from "node:dgram";
 import { randomBytes } from "node:crypto";
 import { networkInterfaces } from "node:os";
 import { looksLikeTunnel } from "./route-via.mjs";
+import { MAX_STRANGERS } from "./lan-requests.mjs";
 import {
-  beaconPayload, beaconVerdict, hostId, notePeer, readBeacon,
+  beaconPayload, beaconVerdict, formerHostId, hostId, notePeer, readBeacon,
   ANNOUNCE_MS, MAX_BEACON_BYTES,
 } from "./lan-sync.mjs";
 
@@ -166,6 +167,10 @@ export function createBeacon({
    *  is running, and hashing a hostname thirty seconds apart forever is work
    *  nobody asked for. See hostId. */
   const host = hostId();
+  /** The id a deck from before the key sends from this computer, which is
+   *  never sent from here and only ever read: a beacon carrying it is an older
+   *  deck on this same machine. See formerHostId. */
+  const formerHost = formerHostId();
   const peers = new Map();
   let sock = null;
   /**
@@ -202,7 +207,13 @@ export function createBeacon({
   /** When this deck last answered a deck it had not heard, so answering cannot
    *  become a storm, and which decks it has already answered — without the
    *  second, a deck that is never accepted is answered again on every packet
-   *  for as long as both are running. */
+   *  for as long as both are running.
+   *
+   *  NEVER MORE OF THEM THAN THE HEARD LIST KEEPS (MAX_STRANGERS, #1738). A
+   *  fingerprint is sixteen hex characters anybody on the network can make up,
+   *  and each new one was an entry kept for the life of the process. The one
+   *  answered longest ago goes first; heard again, it is answered once more,
+   *  which is one packet. */
   let repliedAt = 0;
   const answered = new Set();
 
@@ -280,7 +291,7 @@ export function createBeacon({
     try { via = routeFor(rinfo.address); } catch { via = "lan"; }
     if (!via) return;
     const beacon = readBeacon(msg);
-    const verdict = beaconVerdict(beacon, { selfFp: fp, selfInstance: instance, selfHost: host, trusted: trusted() });
+    const verdict = beaconVerdict(beacon, { selfFp: fp, selfInstance: instance, selfHost: host, formerHost, trusted: trusted() });
     // ANSWER A DECK WE HAVE NEVER HEARD, once, WHOEVER IT IS — and that last
     // part is the change. It used to answer only a deck already in the group,
     // which was fine when a group existed. Now the first thing a new deck has
@@ -300,6 +311,10 @@ export function createBeacon({
     if (newToUs && now() - repliedAt > REPLY_COOLDOWN_MS) {
       repliedAt = now();
       answered.add(beacon.fp);
+      for (const old of answered) {
+        if (answered.size <= MAX_STRANGERS) break;
+        answered.delete(old);
+      }
       // A deck that reached this one over the tailnet is answered there too:
       // a broadcast never gets back down its tunnel.
       announce(via === "tailscale" ? [rinfo.address] : []);

package/src/server/lan-deck.mjs

@@ -234,7 +234,9 @@ export const lanEngine = createEngine({
       const before = heldPrefs.current();
       const after = await heldPrefs.update(withShared(key));
       if (after?.lan?.shared === before?.lan?.shared) return;   // it was already ticked
-      await lanEngine.apply({ shared: after.lan.shared });
+      // With the mark that says an arrival ticked it, which decides who it is
+      // offered to — see sharedWith in lan-sync.mjs.
+      await lanEngine.apply({ shared: after.lan.shared, onward: after.lan.onward });
     } catch (err) {
       console.error(`${PRODUCT}: lan sync could not share the account it just received:`, err?.message ?? err);
     }
@@ -341,6 +343,10 @@ export function lanApplyFields(prefs, { load = false, env = process.env } = {})
     enabled: lanEnabled(prefs, env),
     name: lan.name || defaultName(),
     shared: Array.isArray(lan.shared) ? lan.shared : [],
+    // Which of those an arrival ticked, so a deck the accept switch paired is
+    // not offered them — see sharedWith in lan-sync.mjs. Read with `shared`,
+    // from the same copy, so the two always agree.
+    onward: Array.isArray(lan.onward) ? lan.onward : [],
     autoAsk: lan.autoAsk !== false,
     autoAccept: lan.autoAccept !== false,
     pairingMode: lan.pairingMode === "invite" ? "invite" : "automatic",

package/src/server/lan-engine.mjs

@@ -296,7 +296,9 @@ export function createEngine({
   routes = null,
 } = {}) {
   let cfg = {
-    enabled: false, name: defaultName(), secret: "", shared: [], trusted: [], unpaired: [], port: 0,
+    // `onward`: which of `shared` an arrival ticked rather than a person — see
+    // sharedWith in lan-sync.mjs.
+    enabled: false, name: defaultName(), secret: "", shared: [], onward: [], trusted: [], unpaired: [], port: 0,
     autoAsk: true, autoAccept: true, pairingMode: "automatic", aliases: {},
     // Tell paired decks which shared account this one is on — see currentFor.
     shareActive: true,
@@ -822,6 +824,13 @@ export function createEngine({
         // revoked this peer. Keep the imported slot, but do not turn it into
         // a newly shared credential on behalf of an obsolete transfer.
         if (ok && stillPaired() && ticksOnArrival(step, viaOf(peer), trustedPeer(cfg.trusted, conn.peerFp))) {
+          // MARKED AS THIS ARRIVAL'S TICK, here and in what onShared keeps, so
+          // it is offered to the decks somebody here chose and not to one the
+          // accept switch paired — see sharedWith. Only while nobody has
+          // ticked the account already: a person's tick stays a person's.
+          if (!cfg.shared.includes(step.key) && !cfg.onward?.includes(step.key)) {
+            cfg = { ...cfg, onward: [...(cfg.onward ?? []), step.key] };
+          }
           try { await onShared?.(step.key); }
           catch { /* the account is here; the tick is retried the next time one arrives */ }
         }

package/src/server/lan-manifest.mjs

@@ -4,14 +4,15 @@
 // two maps only these fill, so saying and hearing sit in one file as they sat
 // side by side in the engine. The rules for the lists themselves are
 // lan-copies.mjs's, and the card's are lan-about.mjs's.
-import { currentFor, heardCurrent, manifestFor, offered } from "./lan-sync.mjs";
+import { currentFor, heardCurrent, manifestFor, offered, sharedWith } from "./lan-sync.mjs";
 import { openAbout, sealAbout } from "./lan-about.mjs";
 
 /**
  * `about` is this deck's own card, or null for a deck built without one. `now`
  * is the engine's clock. `myFp` answers this deck's fingerprint as it is at
  * the moment of asking — a restart for a new key changes it — and `settings`
- * the settings in force, of which a manifest reads `shared` and `shareActive`.
+ * the settings in force, of which a manifest reads `shared`, `onward`,
+ * `trusted` and `shareActive`.
  */
 export function createManifests({ about, now, myFp, settings }) {
   /** What each paired deck said about itself — version, operating system,
@@ -35,13 +36,15 @@ export function createManifests({ about, now, myFp, settings }) {
   };
 
   /** This deck's manifest for the deck on the other end of `key`: the accounts
-   *  it shares, which of them it is on, and its card. One frame whichever way
-   *  it travels — the question a round asks, and the answer `serve` gives. */
+   *  it shares with that deck (see sharedWith), which of them it is on, and its
+   *  card. One frame whichever way it travels — the question a round asks, and
+   *  the answer `serve` gives. */
   const manifestFrame = (accounts, key, toFp) => {
     const cfg = settings();
+    const shared = sharedWith(cfg, toFp);
     return {
-      t: "manifest", accounts: manifestFor(accounts, cfg.shared),
-      ...currentFor(accounts, cfg.shared, cfg.shareActive),
+      t: "manifest", accounts: manifestFor(accounts, shared),
+      ...currentFor(accounts, shared, cfg.shareActive),
       ...cardFor(key, toFp),
     };
   };

package/src/server/lan-requests.mjs

@@ -6,6 +6,7 @@
 // this decides who is on which list and when that accept is pressed.
 
 import { pairable, PRESENT_MS } from "./lan-sync.mjs";
+import { inTailnetBlock } from "./tailscale.mjs";
 
 /**
  * The most decks the heard list keeps at once (#1738).
@@ -57,6 +58,21 @@ export const REQUEST_MS = 10 * 60_000;
 export const asksOn = (cfg, via) => cfg.pairingMode !== "invite" && (via === "tailscale" ? !!cfg.tailscale && cfg.tailscaleAsk !== false : !!cfg.autoAsk);
 export const saysYesOn = (cfg, via) => cfg.pairingMode !== "invite" && (via === "tailscale" ? !!cfg.tailscale && cfg.tailscaleAccept !== false : !!cfg.autoAccept);
 
+/**
+ * Whether a switch may press accept on a request at all, by where it came from:
+ * the Tailscale pair only for the owner's own machine, and the local pair only
+ * for an address that is plainly on the local network.
+ *
+ * AN ADDRESS IN TAILSCALE'S BLOCK IS NOT PLAINLY LOCAL. Once Tailscale has
+ * been read and is running, routeOf places every such address on the tailnet,
+ * and this asks the first question of it. One that still reads as the local
+ * network is one nothing here has placed — no read yet, a read that failed, a
+ * read from before Tailscale came up — and the block is also what carrier NAT
+ * and other overlay networks hand out. Such a deck is a row for somebody to
+ * accept, as an unknown tailnet machine is, rather than a local one by default.
+ */
+const switchMayAnswer = (via, own, addr) => (via === "tailscale" ? own : !inTailnetBlock(addr));
+
 /**
  * `settings` answers the engine's settings in force at the moment of asking,
  * and `engineNow` the engine itself, whose accept is what a switch presses.
@@ -164,7 +180,7 @@ export function createRequests({ now, settings, routeTo, wasUnpaired, engineNow,
     // An accept the switch pressed that did not pin — the switch's own budget
     // is spent, see MAX_AUTO_PINS in lan-engine.mjs — leaves the request as it
     // would be with the switch off: a row, drawn, for somebody to answer.
-    if (!wasUnpaired(entry.fp) && saysYesOn(cfg, via) && (via === "lan" || own)) {
+    if (!wasUnpaired(entry.fp) && saysYesOn(cfg, via) && switchMayAnswer(via, own, entry.addr)) {
       if (engineNow()?.accept(entry.fp, { byHand: false })) return;
     }
     if (!had) onChange?.();
@@ -234,7 +250,7 @@ export function createRequests({ now, settings, routeTo, wasUnpaired, engineNow,
     // the local one on does not answer a tailnet request, and turning the
     // Tailscale one on answers only the owner's own machines.
     const turnedOn = (f, via) => !f(was, via) && f(settings(), via);
-    const mayAnswer = p => (p.via === "tailscale" ? turnedOn(saysYesOn, "tailscale") && p.own : turnedOn(saysYesOn, "lan"));
+    const mayAnswer = p => turnedOn(saysYesOn, p.via === "tailscale" ? "tailscale" : "lan") && switchMayAnswer(p.via, p.own, p.addr);
     for (const [fp, p] of [...pending]) if (!wasUnpaired(fp) && mayAnswer(p)) engineNow().accept(fp, { byHand: false });
     // The same for the other direction: switching `ask` on with four machines
     // already listed asks those four.

package/src/server/lan-serve.mjs

@@ -5,7 +5,7 @@
 // answered at all. It keeps nothing of its own: every check reads the
 // engine's settings, listener and key at the moment it is made, because any
 // of them can change while the store is read.
-import { credentialAad, seal, slotFor, transferChallenge, trustedPeer } from "./lan-sync.mjs";
+import { credentialAad, seal, sharedWith, slotFor, transferChallenge, trustedPeer } from "./lan-sync.mjs";
 import { liveLoginIs } from "./account-health.mjs";
 
 /**
@@ -58,8 +58,10 @@ export function createServe({
         // A listener may have authenticated this socket before its owner
         // unpaired the caller or switched sharing off. Recheck at the moment
         // a credential is requested and again after every asynchronous read.
+        // What this deck offers THAT deck, which for one the accept switch
+        // paired is less than everything ticked — see sharedWith.
         const maySend = () => settings().enabled && !!serverNow() && !!trustedPeer(settings().trusted, ctx.peerFp)
-          && settings().shared.includes(msg.key);
+          && sharedWith(settings(), ctx.peerFp).includes(msg.key);
         if (!maySend()) return ctx.send({ t: "no", why: "not shared" });
         // A SECOND PROOF, for the one operation that moves a credential. The
         // session says who connected; this says they are asking for this