ccdeck 3.38.0 → 3.38.1

package/dist/web/index.html

@@ -64,8 +64,8 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-C_h8mR-c.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-0cUs2Jed.css">
+    <script type="module" crossorigin src="/assets/index-DnnkOgia.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-D-HX6Mea.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.38.0",
+  "version": "3.38.1",
   "description": "Local dashboard for Claude Code and Codex CLI sessions: which Claude Code session needs input, every tool call and Claude Code subagent live, token cost and quota, several Claude accounts. Run npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -70,7 +70,8 @@
     "3.36.8",
     "3.36.9",
     "3.37.0",
-    "3.38.0"
+    "3.38.0",
+    "3.38.1"
   ],
   "3.37.1": [
     {

package/src/server/deck-prefs.mjs

@@ -133,8 +133,11 @@ export const DEFAULTS = Object.freeze({
     // WHAT MAKES IT SURVIVABLE IS THE GATE THAT NEVER CHANGED: `shared` is
     // empty, so a deck that pairs is offered NOTHING until somebody ticks a
     // login here. Pairing is a name in a list; a login is the thing worth
-    // having, and it still takes a deliberate tick on this machine. A deck on a
-    // network it does not own turns this off in the dialog, in one press.
+    // having, and it still takes a deliberate tick on this machine. The other
+    // direction is not gated by a tick here, since 3.38.1: a deck the switch
+    // pairs adds and repairs the logins a person ticked on it, as any paired
+    // deck does (see roundWith), and never replaces one that works. So a deck
+    // on a network it does not own turns this off in the dialog, in one press.
     autoAsk: true,
     autoAccept: true,
     pairingMode: "automatic",

package/src/server/lan-engine.mjs

@@ -397,7 +397,8 @@ export function createEngine({
    * is new.
    *
    * Or one the accept switch chose for them, which `auto` says and the pin
-   * keeps — see addTrusted, and roundWith for what such a deck may not do.
+   * keeps — see addTrusted, and sharedWith in lan-sync.mjs for what such a
+   * deck is not handed.
    */
   const pin = ({ fp, pub, name }, { auto = false } = {}) => {
     const { list, added } = addTrusted(cfg.trusted, { fp, pub, name, at: now(), ...(auto ? { auto: true } : {}) });
@@ -727,11 +728,11 @@ export function createEngine({
       if (!stillPaired()) throw new Error("peer no longer paired");
       if (theirs?.t !== "manifest" || !Array.isArray(theirs.accounts)) throw new Error("no manifest");
       const list = keepManifest(conn.key, theirs, conn.peerFp);
-      // FROM A DECK SOMEBODY HERE CHOSE, NEITHER AN ADD NOR A HEAL NEEDS MY
-      // TICK. Adding is the case the owner asked for by name: an account that
-      // appears among the decks I paired with appears on all of them, which is
-      // the whole of "I do not want to paste blobs any more". What can reach
-      // this is what a deck somebody here pressed accept on chose to offer.
+      // FROM ANY PAIRED DECK, NEITHER AN ADD NOR A HEAL NEEDS MY TICK. Adding
+      // is the case the owner asked for by name: an account that appears among
+      // the decks I paired with appears on all of them, which is the whole of
+      // "I do not want to paste blobs any more". What can reach this is what a
+      // paired deck chose to offer.
       //
       // A heal used to need the tick, on the reasoning that it replaces a slot
       // I already have. It replaces only one claude-swap has quarantined, with
@@ -746,13 +747,28 @@ export function createEngine({
       // so this is the ordinary case between one person's machines, not an
       // edge.
       //
-      // WHICH IS ONLY TRUE OF A DECK SOMEBODY CHOSE. The accept switch presses
-      // accept for the owner, so "somebody here pressed accept" is not a
-      // premise about a deck it paired: nobody here chose that deck, and the
-      // logins this store holds would be whatever it decided to offer. What a
-      // deck the switch paired offers comes in — added or healed — only for an
-      // account ticked here, and a person's own press or invite takes the mark
-      // off its pin (see addTrusted).
+      // A DECK THE SWITCH PAIRED INCLUDED, which is what 3.33.0 got wrong. It
+      // held such a deck to the tick — what it offered came in only for an
+      // account ticked here — on the reasoning that nobody here chose it. On
+      // the shipped defaults that was a deadlock rather than a gate. The
+      // accept switch ships on, so two of one person's machines pair by it;
+      // the setup dialog lists only this deck's own accounts, so a login this
+      // deck lacks cannot be ticked here; so an add from such a deck could
+      // never pass. A Mac ticked eight working logins, the deck it had paired
+      // with by the switch received none of them, ever, and its round line
+      // read "all logins fine". The owner chose fully automatic (2026-10-06):
+      // whoever made the pairing, a round takes everything plan() returns.
+      //
+      // What stands between a deck nobody here chose and this store does not
+      // rest on the tick, and none of it moved. plan() never replaces a login
+      // that works here (syncAction never asks for a forced import). A giving
+      // deck hands a deck its switch paired only what a PERSON ticked on it,
+      // not what an arrival ticked onward (sharedWith in lan-sync.mjs). And
+      // nothing that arrives from one is ticked onward here (ticksOnArrival).
+      // What it costs is the switch's own: on a network the owner does not
+      // control, a deck the switch pairs can add the logins ticked on it — so
+      // the dialog and the README say to turn the switch off there.
+      //
       // OVER `list`, NOT THE RAW ARRAY. `offered`, which keepManifest runs the
       // list through above (see lan-manifest.mjs), slices to 50 and type-
       // filters `key` and `email`; this line read `theirs.accounts` and got
@@ -763,15 +779,7 @@ export function createEngine({
       // the store lock, while the panel drew 50 and every other paired deck
       // waited behind it. `step.key` also reached transferChallenge and
       // importAccount untyped, which `offered`'s filter would have caught.
-      const chosen = () => trustedPeer(cfg.trusted, conn.peerFp)?.auto !== true;
-      const takes = step => chosen() || cfg.shared.includes(step.key);
-      const wanted = plan(mine, list).filter(takes);
-      // TWO CHECKS, BECAUSE THEY END DIFFERENT THINGS. Losing the session —
-      // LAN switched off, the peer unpaired (`stillPaired`, above) — ends the
-      // round. From a deck the switch paired, an account unticked mid-round
-      // ends only that step: the next one may still be ticked, and the skipped
-      // row says why rather than vanishing.
-      const stillWanted = takes;
+      const wanted = plan(mine, list);
       /** One login, asked for and opened: a `want` carrying its own proof that
        *  names the account (see transferChallenge), and the `have` opened under
        *  the additional data it was sealed with. The login, or why there is
@@ -790,15 +798,16 @@ export function createEngine({
         return blob ? { blob } : { why: "could not open" };
       };
       let cut = false;
+      // Losing the session — LAN switched off, the peer unpaired — ends the
+      // round, checked before each question and again before each import. A
+      // tick changed here mid-round ends nothing: no step reads one.
       for (const step of wanted) {
         if (!stillPaired()) { cut = true; break; }
-        if (!stillWanted(step)) { done.push({ ...step, ok: false, why: "not shared" }); continue; }
         const { blob, why } = await wantLogin(step);
         if (!blob) { done.push({ ...step, ok: false, why }); continue; }
-        // Unpairing, disabling LAN, or unticking a heal while export was in
-        // progress takes effect before the received credential touches disk.
+        // Unpairing or disabling LAN while export was in progress takes effect
+        // before the received credential touches disk.
         if (!stillPaired()) { cut = true; break; }
-        if (!stillWanted(step)) { done.push({ ...step, ok: false, why: "not shared" }); continue; }
         // A verdict rather than a boolean, because "refused" and "kept the
         // slot it already has" are different things to tell somebody and the
         // second one used to be reported as success. A bare `true` is still
@@ -825,11 +834,11 @@ export function createEngine({
         // be asleep or on another network. Nothing new is exposed — the login
         // came FROM the group, so the group has it.
         //
-        // ONLY AN ADD, and only from the local network. A heal already needed
-        // the tick to happen at all (the filter above), so there is nothing to
-        // add for one; and a tailnet reaches further than the person's own
-        // machines, which is a decision they make for themselves rather than
-        // one an arrival makes for them.
+        // ONLY AN ADD, only from the local network, and only from a deck
+        // somebody here chose — see ticksOnArrival for why each. A healed slot
+        // was here already and its tick is somebody's decision either way; a
+        // tailnet reaches further than the person's own machines; and what a
+        // deck the switch paired brings is not passed on in this deck's name.
         // The store can finish an import after the owner disabled LAN or
         // revoked this peer. Keep the imported slot, but do not turn it into
         // a newly shared credential on behalf of an obsolete transfer.
@@ -1026,9 +1035,6 @@ export function createEngine({
     const card = id => ({
       ...heardOf(id),
       pairedAt: trustedPeer(cfg.trusted, id)?.at ?? null,
-      // And whether a switch said that yes rather than a person, which is
-      // what the dialog needs to say which logins will not arrive from it.
-      ...(trustedPeer(cfg.trusted, id)?.auto ? { autoPaired: true } : {}),
     });
     for (const p of [...beacon.peers.values(), ...dials.rows()]) {
       if (!stillListed(p, now())) continue;

package/src/server/lan-reach.mjs

@@ -536,6 +536,27 @@ export function reachability({ platform, probe, aliases = [], exePath = "", inbo
   return windowsReach({ probe, aliases, exePath, inbound });
 }
 
+/**
+ * The verdict as the status route serves it: `said` is the last one taken, and
+ * `inboundAt` is when a connection from another machine last got in, as the
+ * engine knows it NOW.
+ *
+ * A VERDICT IS TAKEN AT MOST EVERY FIVE MINUTES (see refreshReach in
+ * lan-deck.mjs), and a complaint in it was true only of the moment it was
+ * taken. Reported from the Omarchy box this module's Linux block describes:
+ * its owner ran the two `ufw allow` lines, decks connected straight away —
+ * ufw applies a rule the moment it is added — and the panel went on saying
+ * "ufw is running here…" until the cached verdict expired, because it was
+ * taken before anything had connected. The connection that got in is the
+ * same measurement every platform here already puts above whatever it read,
+ * so it outranks a verdict taken before it, too. The answer is the one the
+ * next probe will give; every other answer is served as it was.
+ */
+export function servedReach(said, inboundAt) {
+  if (!said?.blocked || !inboundAt) return said ?? null;
+  return { blocked: false, why: "inbound seen", category: said.category ?? "", alias: said.alias ?? "" };
+}
+
 // ── the machine nothing can be asked about ──────────────────────────────────
 //
 // Every block above depends on the operating system answering a question.

package/src/server/lan-routes.mjs

@@ -10,6 +10,7 @@
 import { cleanAlias, isAliasKey, lanEnabled, withAlias, withManualEntry } from "./deck-prefs.mjs";
 import { heldPrefs } from "./prefs-state.mjs";
 import { lanEngine, lastReach, refreshReach, tailnet } from "./lan-deck.mjs";
+import { servedReach } from "./lan-reach.mjs";
 import { IDLE_MS as TAILNET_IDLE_MS } from "./tailscale.mjs";
 import { readBody, send } from "./http-io.mjs";
 
@@ -21,7 +22,9 @@ export function handleLanStatus(req, res) {
   // Behind the answer, like the reach probe: the dialog's poll is what finds a
   // Tailscale somebody installed while the deck was running.
   if (lanEnabled(heldPrefs.current())) void tailnet.freshen(TAILNET_IDLE_MS);
-  return send(res, 200, { ok: true, ...lanEngine.status(), reach: lastReach() });
+  // Read against what has got in since it was taken — see servedReach.
+  const status = lanEngine.status();
+  return send(res, 200, { ok: true, ...status, reach: servedReach(lastReach(), status.inboundAt) });
 }
 
 /**

package/src/server/lan-sync.mjs

@@ -464,11 +464,12 @@ export function trustedPeer(trusted, fp) {
  * told nothing changed.
  *
  * `auto` SAYS A SWITCH MADE THE PIN, not a person — the accept switch pressing
- * accept for the owner. A pin that says so may take what this deck shares and
- * may not place logins here: see roundWith in lan-engine.mjs. A person's pin
- * of the same key takes the mark away, because pressing accept, or pairing by
- * invite, is the choice the switch only stood in for; a switch never puts it
- * back on a pin a person made.
+ * accept for the owner. A pin that says so is handed only what a person ticked
+ * here (see sharedWith), and what it brings is not ticked onward here (see
+ * ticksOnArrival in lan-engine.mjs); it places logins here like any paired
+ * deck, since 3.38.1 — see roundWith. A person's pin of the same key takes the
+ * mark away, because pressing accept, or pairing by invite, is the choice the
+ * switch only stood in for; a switch never puts it back on a pin a person made.
  */
 export function addTrusted(trusted, entry) {
   const list = Array.isArray(trusted) ? trusted : [];