ccdeck 3.36.9 → 3.37.1

package/src/server/lan-sync.mjs

@@ -101,8 +101,11 @@
 // downloads a week and four dependencies of its own; running unmaintained
 // cryptography to protect live credentials is worse than the plain construction
 // in lan-wire.mjs.
-import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { createHash, createHmac } from "node:crypto";
+import { readFileSync } from "node:fs";
 import os from "node:os";
+import { win32 as winPath } from "node:path";
 // What two decks say once one has dialled the other — the keys, the proofs and
 // the seals — is lan-wire.mjs's, and so is PROTOCOL, which the beacon below
 // carries: every label there is derived under it, and that file cannot import
@@ -211,9 +214,74 @@ export function cleanName(raw, fallback = "unnamed deck") {
  * The home directory is in it so that a copied `~/.claude` — which is how two
  * real machines end up holding one key, and the reason `id-clash` exists —
  * still reads as two machines when the hostnames differ, which they do.
+ *
+ * AND KEYED, because a plain hash of those two hid neither. The hostname rides
+ * in the same packet as the deck's name on a deck nobody renamed, which left
+ * only the home directory to guess — and /Users/<name>, /home/<name> and
+ * C:\Users\<name> over a list of first names is a guess that lands. The key is
+ * a secret this machine already has and never sends (see machineSecret): the
+ * same for every deck on it, so they still agree without writing anything, and
+ * another machine's own, so a copied config reads as another machine even under
+ * the same hostname. A machine with no such secret to read keys with nothing
+ * and sends the plain hash every deck sent before (see formerHostId).
+ */
+export function hostId({ hostname = os.hostname(), home = os.homedir(), key = machineKey() } = {}) {
+  const input = `${machineName(hostname)}\u0000${home}`;
+  if (!key) return createHash("sha256").update(input).digest("hex").slice(0, 12);
+  return createHmac("sha256", key).update(`ccdeck host id\u0000${input}`).digest("hex").slice(0, 12);
+}
+
+/**
+ * This machine's id as a deck from before the key sends it — the plain hash.
+ *
+ * Never sent by this one. Read so that a beacon carrying it is known for what
+ * it is: an older deck on this same computer, which a newer one must not take
+ * for a stranger to pair with or for a copy of its key (see beaconVerdict). It
+ * names this machine and no other, because its inputs are this machine's.
+ */
+export function formerHostId({ hostname = os.hostname(), home = os.homedir() } = {}) {
+  return hostId({ hostname, home, key: "" });
+}
+
+/**
+ * The secret hostId is keyed with: an id the operating system keeps for this
+ * machine, readable by any user on it and never sent anywhere by this deck —
+ * systemd's (or D-Bus's) machine id on Linux, the platform UUID on a Mac, the
+ * machine GUID on Windows. Null where none can be read: a container without a
+ * machine id, a tool that would not run.
+ *
+ * Only ever the key of an HMAC, never the message and never on the wire, which
+ * is how systemd asks for its machine id to be used by an application.
  */
-export function hostId({ hostname = os.hostname(), home = os.homedir() } = {}) {
-  return createHash("sha256").update(`${machineName(hostname)}\u0000${home}`).digest("hex").slice(0, 12);
+export function machineSecret({ platform = process.platform, env = process.env, readFile = readFileSync, run = execFileSync } = {}) {
+  const tool = (file, args, pattern) => {
+    try {
+      const out = run(file, args, { encoding: "utf8", timeout: 3_000, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] });
+      return pattern.exec(String(out ?? ""))?.[1] ?? null;
+    } catch { return null; }
+  };
+  if (platform === "darwin") {
+    return tool("/usr/sbin/ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], /"IOPlatformUUID"\s*=\s*"([0-9A-Fa-f-]{16,})"/);
+  }
+  if (platform === "win32") {
+    const reg = winPath.join(env.SystemRoot || env.windir || "C:\\Windows", "System32", "reg.exe");
+    return tool(reg, ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"], /MachineGuid\s+REG_SZ\s+([0-9A-Fa-f-]{16,})/);
+  }
+  for (const file of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+    try {
+      const id = String(readFile(file, "utf8") ?? "").trim();
+      if (/^[0-9A-Fa-f-]{16,}$/.test(id)) return id;
+    } catch { /* the next place, or none */ }
+  }
+  return null;
+}
+
+/** machineSecret, read once per process: it cannot change while one runs, and
+ *  on a Mac or Windows it is a process to start. Empty when there is none. */
+let machineKeyRead = null;
+function machineKey() {
+  machineKeyRead ??= machineSecret() ?? "";
+  return machineKeyRead;
 }
 
 /**
@@ -325,15 +393,18 @@ export function readBeacon(buf, { maxBytes = MAX_BEACON_BYTES } = {}) {
  * broadcast on every interface it owns, and filtering by address would need a
  * list of them that changes when a VPN comes up.
  */
-export function beaconVerdict(beacon, { selfFp, selfInstance, selfHost, trusted } = {}) {
+export function beaconVerdict(beacon, { selfFp, selfInstance, selfHost, formerHost, trusted } = {}) {
   if (!beacon) return "unreadable";
+  // THIS COMPUTER'S ID, as this deck sends it or as a deck from before the key
+  // did (see formerHostId) — both name this machine and no other.
+  const here = !!selfHost && !!beacon.host && (beacon.host === selfHost || (!!formerHost && beacon.host === formerHost));
   // ANOTHER DECK ON THIS COMPUTER. Not this process — a different key, honestly
   // its own — and still nothing to pair with: both read one claude-swap store,
   // so neither holds a login the other could heal. It used to be filtered by
   // the address the packet came from, which is true and needs the list of this
   // machine's addresses to be current; the machine's own id needs nothing and
   // is the same answer.
-  if (selfHost && beacon.host && beacon.host === selfHost && beacon.fp !== selfFp) return "self";
+  if (here && beacon.fp !== selfFp) return "self";
   if (beacon.fp === selfFp) {
     // OUR OWN NAME, FROM SOMEBODY ELSE'S PROCESS. Two decks sharing a config
     // directory hold the same key — and so does the second machine when
@@ -363,7 +434,7 @@ export function beaconVerdict(beacon, { selfFp, selfInstance, selfHost, trusted
     // the OTHER one: a `~/.claude` copied to a second machine, where two real
     // decks would otherwise be permanently invisible to each other.
     if (selfInstance && beacon.instance !== selfInstance) {
-      return selfHost && beacon.host === selfHost ? "self" : "id-clash";
+      return here ? "self" : "id-clash";
     }
     return "self";
   }
@@ -430,6 +501,26 @@ export function dropTrusted(trusted, fp) {
   return (Array.isArray(trusted) ? trusted : []).filter(t => t && t.fp !== fp);
 }
 
+/**
+ * The accounts this deck offers the paired deck `fp`: everything ticked here,
+ * less what an arrival ticked when that deck is one the accept switch paired.
+ *
+ * An account that arrives from a deck somebody here chose is ticked on arrival
+ * (#1188), and `onward` keeps which ticks those were. The reasoning for that
+ * tick is that the group already has the login, and the group is the decks a
+ * person here chose. A deck the switch paired (`auto`, see addTrusted) is
+ * offered what a person ticked and nothing else, which is what keeps the
+ * switch's promise: a deck that pairs is offered nothing until somebody ticks
+ * a login here. A person who unticks and ticks the account again takes the
+ * mark off, and from then on it is offered like any other tick.
+ */
+export function sharedWith(cfg, fp) {
+  const shared = Array.isArray(cfg?.shared) ? cfg.shared : [];
+  if (trustedPeer(cfg?.trusted, fp)?.auto !== true) return shared;
+  const onward = Array.isArray(cfg?.onward) ? cfg.onward : [];
+  return shared.filter(key => !onward.includes(key));
+}
+
 /**
  * The decks worth offering to pair with, out of everything that has ever been
  * heard.

package/src/server/lifecycle.mjs

@@ -47,6 +47,11 @@ let _onRestart = null;
 // directly, or an embedder — and /api/shutdown then answers 501 rather than
 // pretending.
 let _onStop = null;
+// Told when the deck starts updating itself — the Upgrade press, the npx
+// relaunch onto the latest, the away-update — so the reporter can write down
+// that the next version came from the deck (index.mjs hands it in). Absent,
+// nothing is told.
+let _onSelfUpdate = null;
 // A stop is in flight. Two sockets asking at once must not both start one, and
 // the response's 'finish' and 'close' can both fire for the same request.
 let _stopping = false;
@@ -66,9 +71,10 @@ let _deckReady = false;
  * and the stop it may hand to, whether a restart would have a log to replay,
  * and the two in-flight flags and the ready flag, all back to a fresh boot's.
  */
-function armLifecycle({ onRestart, onStop, persist }) {
+function armLifecycle({ onRestart, onStop, persist, onSelfUpdate = null }) {
   _onRestart = typeof onRestart === "function" ? onRestart : null;
   _onStop = typeof onStop === "function" ? onStop : null;
+  _onSelfUpdate = typeof onSelfUpdate === "function" ? onSelfUpdate : null;
   _stopping = false;
   _canRestart = _onRestart != null && persist != null;
   // A new listener is a new boot, whatever a previous one had got as far as
@@ -155,9 +161,16 @@ async function handleUpgrade(_req, res) {
   // lands in the first moments of a boot, or on a server nothing marked ready.
   await pinRunningBuild();
   const out = startUpgrade({ pkgRoot: PKG_ROOT });
+  if (out.ok) selfUpdateStarted();
   send(res, out.ok ? 200 : 409, out);
 }
 
+/** The deck is updating itself: say so to whoever armed it (the reporter's
+ *  note, so the next version's "update" can tell). Never throws. */
+function selfUpdateStarted() {
+  try { void Promise.resolve(_onSelfUpdate?.()).catch(() => {}); } catch { /* a note, nothing more */ }
+}
+
 // Restart is a two-party act: this half answers before it stops listening, so
 // the caller learns it was accepted rather than losing the socket mid-reply.
 //
@@ -214,6 +227,7 @@ async function handleRestart(req, res) {
     }
   }
   _restarting = true;
+  if (mode === "npx") selfUpdateStarted();
   // Accepted either way — the ask is good and the launcher holds on to it — but
   // the two are not the same event and answering 200 to both would be this
   // window's second untruth rather than its first. Between this listener
@@ -394,13 +408,15 @@ async function awayUpdateTick() {
     // Pinned before npm is spawned, never after it — see pinned-build.mjs. On a
     // deck bin/deck.js has marked ready this is a promise that settled long ago.
     await pinRunningBuild();
-    su.startUpgrade({ pkgRoot: PKG_ROOT });
+    const started = su.startUpgrade({ pkgRoot: PKG_ROOT });
+    if (started?.ok) selfUpdateStarted();
     return step.act;
   }
   // handleRestart's own check for the npx path, for the same reason: the mode
   // comes from the install on disk, and a spec it cannot name is no relaunch.
   if (step.act === "npx" && !su.npxRestartSpec(PKG_ROOT)) return null;
   _restarting = true;
+  if (step.act === "npx") selfUpdateStarted();
   handOffRestart(step.act === "npx" ? "npx" : null);
   return step.act;
 }

package/src/server/log-replay.mjs

@@ -11,7 +11,7 @@ import { existsSync } from "node:fs";
 import { PRODUCT } from "./brand.mjs";
 import { codexCwdInWorkspace } from "./log-election.mjs";
 import { linesFromEnd, linesFromStart } from "./log-tail.mjs";
-import { ENVELOPE_CHARS, MAX_BUFFER, MAX_BUFFER_CHARS, MAX_RING_ENTRIES, isEnrichment, payloadChars } from "./ring-bounds.mjs";
+import { ENVELOPE_CHARS, MAX_BUFFER, MAX_BUFFER_CHARS, MAX_RING_ENTRIES, isEnrichment, isReservedEventName, payloadChars } from "./ring-bounds.mjs";
 // event-pipeline.mjs's pushEvent, reached without importing it — see
 // event-sink.mjs.
 import { pushEvent } from "./event-sink.mjs";
@@ -60,7 +60,8 @@ import { pushEvent } from "./event-sink.mjs";
  *     everything before it. It has not been written to the log since #698, but
  *     logs the decks before that wrote still carry it, and dropping it on a
  *     scoped deck would replay the state a user had explicitly cleared, so it
- *     is always admitted.
+ *     is always admitted — when the server recorded it, which replayLog
+ *     checks before asking this (see `usable` there).
  *   * a payload with no cwd and no session the map has seen — refused on a
  *     scoped deck, which is exactly what `capturesSession` decides live for a
  *     session that never said where it runs.
@@ -324,7 +325,12 @@ export async function replayLog(filePath, workspace = "", {
       return null;
     }
   };
-  const usable = (evt) => evt && typeof evt === "object" && evt.payload;
+  // A control marker counts only when the server itself recorded it: the one
+  // writer of `__clear` has always stamped it `internal`, and since #698 it is
+  // not written at all. A line under a reserved name from anywhere else is not
+  // the deck's instruction, and replaying it would hide everything before it.
+  const usable = (evt) => evt && typeof evt === "object" && evt.payload
+    && (evt.source === "internal" || !isReservedEventName(evt.payload.hook_event_name));
 
   let count = 0;
   if (admits.orderDependent) {

package/src/server/login-service.mjs

@@ -32,6 +32,7 @@
 // tested. Two policies over one process is how `ccdeck --stop` becomes a
 // suggestion the machine overrules a second later.
 import { inApp } from "./app-host.mjs";
+import { stableNodePath } from "./stable-node.mjs";
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
@@ -123,6 +124,10 @@ ${vars}
 `;
 }
 
+/** A value as systemd will read it back: `%` starts a specifier anywhere in a
+ *  unit, and `%%` is the literal. */
+const sdEscape = (s) => String(s).replace(/%/g, "%%");
+
 /**
  * The systemd --user unit.
  *
@@ -130,7 +135,19 @@ ${vars}
  * still receiving updates. No Restart=, for the reason in the header.
  */
 export function unitFor({ execPath, script, logPath, args = [], env = {}, product = "ccdeck" } = {}) {
-  const cmd = [execPath, script, ...args].map(a => (/\s/.test(a) ? `"${a}"` : a)).join(" ");
+  // EVERY VALUE, not only the Environment= lines below. systemd expands `%`
+  // in StandardOutput=/StandardError= and in ExecStart as well, and `$NAME` in
+  // ExecStart; those were written raw, so a deck home like the
+  // `/home/ana/100%backup` below had its log path rewritten — systemd 259
+  // drops the setting with "Failed to resolve unit specifiers … ignoring" for
+  // an unknown one and substitutes a known one (`%b`, the boot ID) silently —
+  // and the same `%` in an install path made ExecStart a fatal error.
+  // An argument with whitespace, a quote or a backslash is quoted, with the
+  // C escapes systemd's word splitting reads inside the quotes.
+  const cmd = [execPath, script, ...args].map(a => {
+    const v = sdEscape(a).replace(/\$/g, "$$$$");
+    return /[\s"'\\]/.test(v) ? `"${v.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"` : v;
+  }).join(" ");
   // QUOTED, AND `%` ESCAPED. systemd.exec(5) splits an Environment= assignment
   // on whitespace unless the whole thing is double-quoted, and it expands `%`
   // specifiers in the value. ExecStart above quotes its own arguments; this
@@ -146,10 +163,15 @@ export function unitFor({ execPath, script, logPath, args = [], env = {}, produc
   // decks and two LAN keys on one machine". `%b` is the boot-ID specifier, so
   // `/home/ana/100%backup` was rewritten just as quietly.
   //
+  // AND `"` AND `\` ESCAPED INSIDE THOSE QUOTES, which systemd reads with C
+  // escapes: a `"` in the value closed them early and a `\` began an escape,
+  // so `/home/ana/a "quote` and a value ending in `\` were dropped as
+  // "Invalid syntax, ignoring" and `back\slash` came back with a space in it.
+  //
   // The macOS branch was always safe: plistFor puts each value in its own
   // <string> and XML-escapes it. Windows carries none of them.
   const vars = Object.entries({ AGENTS_DECK_DETACHED: "1", ...env })
-    .map(([k, v]) => `Environment="${k}=${String(v).replace(/%/g, "%%")}"`).join("\n");
+    .map(([k, v]) => `Environment="${sdEscape(`${k}=${v}`).replace(/[\\"]/g, "\\$&")}"`).join("\n");
   return `[Unit]
 Description=${product} — live deck of Claude Code + Codex agents
 After=default.target
@@ -158,8 +180,8 @@ After=default.target
 Type=simple
 ${vars}
 ExecStart=${cmd}
-StandardOutput=append:${logPath}
-StandardError=append:${logPath}
+StandardOutput=append:${sdEscape(logPath)}
+StandardError=append:${sdEscape(logPath)}
 
 [Install]
 WantedBy=default.target
@@ -250,7 +272,9 @@ export function taskXmlFor({ execPath, script, args = [], product = "ccdeck" } =
  *
  *   `npx` runs out of ~/.npm/_npx/<hash>/, which npm deletes whenever it feels
  *   like it. A login item pointing at nothing, forever, on a machine where the
- *   user never installed anything.
+ *   user never installed anything. pnpm dlx, bunx and yarn dlx are the same
+ *   case in another cache or temp folder, and callers pass `npx` for all four
+ *   (isOneOffRun).
  *
  *   A CHECKOUT is somebody's working tree. Found by running this: a test boot
  *   from the repo on the author's own machine wrote a LaunchAgent naming
@@ -354,8 +378,40 @@ export function lingerState({ platform = process.platform, run = spawnSync, user
 export const SCOPE_VARS = Object.freeze(["CLAUDE_CONFIG_DIR", "CCDECK_HOME", "CODEX_HOME"]);
 
 export function scopeEnv(env = process.env) {
+  return setOnes(SCOPE_VARS, env);
+}
+
+/**
+ * …and the variables that decide what that deck DOES: every other row of
+ * README's environment table, by name.
+ *
+ * Lost the same way the scope directories were, and with a cost the user had
+ * already said no to. `AGENTS_DECK_NO_REPORTS=1 ccdeck`, or the variable in
+ * ~/.zshrc, installed an item on the first start whose deck ran at the next
+ * login with no veto: an install event with the device fingerprint, a daily
+ * "active", and — AGENTS_DECK_NO_LAN gone too — the beacon on the local
+ * network. A terminal exporting the variable afterwards attached to that deck
+ * rather than starting one of its own, so not even it was spared.
+ *
+ * BY NAME, NOT BY PREFIX. A shell holds tokens and keys a login item has no
+ * business copying into a file in ~/Library/LaunchAgents; the list is what the
+ * deck documents and reads, and a test holds it to README's table. Only the
+ * ones that are set, for the reason scopeEnv gives.
+ */
+export const SETTING_VARS = Object.freeze([
+  "AGENT_DAG_PORT",
+  "AGENTS_DECK_NO_INSTALL", "AGENTS_DECK_NO_DOWNLOAD", "AGENTS_DECK_NO_UPDATE_CHECK", "AGENTS_DECK_NO_STATUS",
+  "AGENTS_DECK_NO_FRESHEN", "AGENTS_DECK_NO_NOTIFY", "AGENTS_DECK_NO_LAN", "AGENTS_DECK_NO_REPORTS",
+  "AGENTS_DECK_CSWAP", "AGENTS_DECK_CLAUDE", "AGENTS_DECK_CCUSAGE", "CLAUDE_SWAP_BACKUP", "AGENTS_DECK_LHM_PORT",
+]);
+
+export function settingsEnv(env = process.env) {
+  return setOnes(SETTING_VARS, env);
+}
+
+function setOnes(names, env) {
   return Object.fromEntries(
-    SCOPE_VARS.filter(k => typeof env?.[k] === "string" && env[k].trim() !== "").map(k => [k, env[k]]),
+    names.filter(k => typeof env?.[k] === "string" && env[k].trim() !== "").map(k => [k, env[k]]),
   );
 }
 
@@ -394,7 +450,11 @@ export function installService({
   platform = process.platform,
   home = homedir(),
   env = process.env,
-  execPath = process.execPath,
+  // The node an upgrade of the same install does not delete, which is not
+  // `process.execPath` on Homebrew or a linked tarball — see stable-node.mjs.
+  // Looked up on THIS machine whatever `platform` asks about: it is this
+  // machine's node that the job will run.
+  execPath = stableNodePath({ env }),
   script,
   logPath,
   // `--at-login` because registering the job also STARTS it, on Linux and
@@ -422,12 +482,29 @@ export function installService({
   // genuinely wants a different job environment — the sandboxed end-to-end
   // test, which passes HOME and the deck's own directories — still says so,
   // and replaces this outright rather than adding to it.
-  serviceEnv = scopeEnv(env),
+  //
+  // The opt-outs ride along for the same reason (settingsEnv): an item that
+  // starts a deck without the shell's AGENTS_DECK_NO_REPORTS is a deck that
+  // reports from the next login on.
+  serviceEnv = { ...scopeEnv(env), ...settingsEnv(env) },
   product = "ccdeck",
   fs = { mkdirSync, writeFileSync },
   run = spawnSync,
+  // Whether systemd is this machine's init — sd_booted(3)'s own test. Only
+  // this machine can be asked, so a Linux job written from anywhere else is
+  // taken to have one.
+  systemd = () => process.platform !== "linux" || existsSync("/run/systemd/system"),
 } = {}) {
   const path = servicePath(platform, home, env);
+  // NO SYSTEMD, NO LOGIN ITEM — Alpine and Gentoo on OpenRC, Void, Devuan, a
+  // container, WSL with systemd off. A unit written there is read by nothing,
+  // and `systemctl` is missing or refuses; the refusal used to read as
+  // "file-only", so the first start said the deck would start at login, saved
+  // the item as installed and never offered again. Asked before anything is
+  // written, so nothing is left behind in a directory nobody reads.
+  if (platform === "linux" && !systemd()) {
+    return { ok: false, path, reason: "this machine does not run systemd" };
+  }
   try {
     // BEFORE THE SERVICE MANAGER IS TOLD ANYTHING. launchd opens
     // StandardOutPath when it starts the job and systemd opens
@@ -464,11 +541,17 @@ export function installService({
     fs.writeFileSync(path, body, { mode: 0o644 });
     const cmd = registerCommand(platform, path);
     const out = run(cmd.file, cmd.args, { encoding: "utf8" });
-    // A registration that failed still leaves the file, and both launchd and
-    // systemd read their directories at the next login — so the service works
-    // from then on either way. Said, not hidden, and not treated as fatal.
+    // A registration that failed still leaves the file. launchd loads every
+    // plist in ~/Library/LaunchAgents at the next login, so on a Mac the item
+    // works from then on. systemd does not: it starts at login only a user
+    // unit that is ENABLED, which is the link the failed `enable` never made,
+    // so the verdict carries the command that makes it. Said, not hidden, and
+    // not treated as fatal.
     if (out?.status !== 0) {
-      return { ok: true, path, how: "file-only", reason: oneLine(out?.stderr || out?.stdout) || `${cmd.file} refused` };
+      const reason = oneLine(out?.stderr || out?.stdout) || `${cmd.file} refused`;
+      return platform === "darwin"
+        ? { ok: true, path, how: "file-only", reason }
+        : { ok: true, path, how: "file-only", reason, enable: `systemctl --user enable ${SERVICE_LABEL}.service` };
     }
     return { ok: true, path, how: cmd.file };
   } catch (err) {

package/src/server/npm-upgrade.mjs

@@ -16,7 +16,7 @@ import { join, resolve } from "node:path";
 import { killTree, shimPath, spawnSpec } from "./exec.mjs";
 import { npmCliLaunch } from "./npx.mjs";
 import {
-  frozenNameInstall, hostPackage, installedName, isGitCheckout, isNpxInstall,
+  frozenNameInstall, hostPackage, installedName, isGitCheckout, isNpxInstall, isOneOffRun,
   PUBLISHED_NAME, successorRoot, upgradeCommand, upgradeName,
 } from "./install-layout.mjs";
 
@@ -78,7 +78,7 @@ export function upgradeSpec(target, platform = process.platform, deps) {
  * Pure so the policy can be read and tested on its own — it is the part that
  * decides whether we are allowed to write to the user's machine.
  */
-export function upgradeBlockedReason({ git, npx, writable, optedOut, frozen }) {
+export function upgradeBlockedReason({ git, npx, oneOff, writable, optedOut, frozen }) {
   if (optedOut) return "opted_out";
   // The maintainer's own tree. Its version leads npm's, and installing over it
   // would replace a working copy with a published tarball.
@@ -87,6 +87,12 @@ export function upgradeBlockedReason({ git, npx, writable, optedOut, frozen }) {
   // place — `npx agents-deck@latest` fetches a DIFFERENT directory, which this
   // process could not switch to even after restarting.
   if (npx) return "npx";
+  // pnpm dlx, bunx and yarn dlx: a cache or temp folder as well, but with no
+  // spec recorded to re-run the way npx's is. Writable, so it looked like a
+  // global install, and `npm i -g` from here installs a copy this process
+  // never runs — the running version never moves, and the away-update tried
+  // again every thirty minutes. The command is shown instead.
+  if (oneOff) return "one_off";
   // A flat install of a retired name: the one shape where `npm i -g <us>@latest`
   // runs cleanly, reports success, and leaves no deck behind — the registry
   // serves a 5 KB pointer for those names now, and npm's reify removes bin/,
@@ -108,8 +114,9 @@ export function upgradeBlockedReason({ git, npx, writable, optedOut, frozen }) {
  *   "install" — `npm i -g` here and restart into the new files.
  *   "npx"     — nothing to install: the supervisor re-runs `npx -y <spec>`,
  *               which fetches a NEW cache directory and hands the port to it.
- *   null      — a checkout, an unwritable prefix, or an explicit opt-out; the
- *               user gets the command and does it themselves.
+ *   null      — a checkout, a one-off runner's cache, an unwritable prefix, or
+ *               an explicit opt-out; the user gets the command and does it
+ *               themselves.
  *
  * Pure, so the policy is one readable expression rather than three conditions
  * spread across the server and the UI.
@@ -182,6 +189,7 @@ export function upgradeBlock(pkgRoot) {
   return upgradeBlockedReason({
     git: isGitCheckout(pkgRoot),
     npx: isNpxInstall(pkgRoot),
+    oneOff: isOneOffRun(pkgRoot),
     // npm -g rewrites the package directory and its parent (the global
     // node_modules), so both have to be ours to write.
     writable: dirWritable(target) && dirWritable(resolve(target, "..")),

package/src/server/pinned-build.mjs

@@ -89,6 +89,9 @@ const PINNED_MODULES = [
   "cli-versions.mjs",
   "session-tracking.mjs",
   "session-enrichment.mjs",
+  // The plans the daily report says, read through import() by depth-facts.mjs.
+  "quota-oauth.mjs",
+  "codex-auth.mjs",
 ];
 
 let _pinned = null;

package/src/server/prefs-routes.mjs

@@ -7,7 +7,7 @@
 // engine had (lan-deck.mjs): what is left of them is a body read, a write
 // through the one, a push to the other, and an answer. The notifier stays in
 // index.mjs, beside the desktop-app connections it notifies through.
-import { notificationsOn, notificationsVetoed, prefsRefusalDetail, prefsWriteRefusal, publicPrefs, reportsVetoed } from "./deck-prefs.mjs";
+import { notificationsOn, notificationsVetoed, pagePatch, prefsRefusalDetail, prefsWriteRefusal, publicPrefs, reportsVetoed } from "./deck-prefs.mjs";
 import { PRODUCT } from "./brand.mjs";
 import { heldPrefs } from "./prefs-state.mjs";
 import { applyLanPrefs, forgetReach, resetLanLoaded } from "./lan-deck.mjs";
@@ -52,13 +52,10 @@ export async function handlePrefsWrite(req, res) {
   let body = null;
   try { body = JSON.parse(raw ?? ""); } catch { /* handled below */ }
   if (!body || typeof body !== "object") return send(res, 400, { ok: false, reason: "bad_request" });
-  // The reports switch has consequences a plain write would skip — a deletion
-  // asked for — so it is changed only through /api/reports, and its state never
-  // by the page at all (#1853).
-  // Which accounts the deck signed in is the deck's to record, on a sign-in it
-  // ran itself (#1893); a page that could write it could give any account a
-  // provenance it never had.
-  const { reports: _reports, report: _report, accounts: _accounts, ...patch } = body;
+  // Only the fields the page edits. The rest — the LAN key and pairings, the
+  // reports switch (#1853), the reporter's state, the accounts the deck signed
+  // in (#1893) — are the deck's own and keep what is on disk; see pagePatch.
+  const patch = pagePatch(body);
   try {
     await heldPrefs.write(patch);
   } catch (err) {

package/src/server/prefs-state.mjs

@@ -35,6 +35,10 @@ let _prefs = { ...DEFAULTS };
  *  it. A write that lands first merges onto the file, but leaves the engine on
  *  what it made up, so it does not count. */
 let _unread = false;
+/** Whether the boot read found no file there at all. A file it could not read
+ *  or make sense of was still a deck that ran here, so only "missing" counts.
+ *  False until the read lands. */
+let _noFile = false;
 
 // Read at import, so `consider` has its answer from the first event. LAN sync
 // used to start from this same read, and it must not: bin/deck.js imports the
@@ -43,7 +47,11 @@ let _unread = false;
 // in — which is the `lan sync (listen): EADDRINUSE` line a second `ccdeck`
 // printed above `deck already running`. The engine starts from the listen that
 // succeeds, in startServer, which is the only process that may hold a port.
-export const prefsRead = loadPrefs().then(r => { _prefs = r.prefs; _unread = r.source === "unreadable"; }).catch(() => {});
+export const prefsRead = loadPrefs().then(r => { _prefs = r.prefs; _unread = r.source === "unreadable"; _noFile = r.source === "missing"; }).catch(() => {});
+
+/** Whether the boot read found no settings file at all: the first run on this
+ *  machine, as far as the deck can tell (reports.mjs times only that one). */
+export const bootFoundNoPrefs = () => _noFile;
 
 export const heldPrefs = Object.freeze({
   /** What the last read or write left here. Never a disk read — see above. */