ccdeck 3.43.1 → 3.43.4

package/dist/web/assets/{index-CzIBjYsB.js → index-Ch4ks76J.js}

@@ -1 +1 @@
-import"./app-ByCusSHX.js";(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.supports("modulepreload"))return;for(const e of document.querySelectorAll('link[rel="modulepreload"]'))i(e);new MutationObserver(e=>{for(const r of e)if(r.type==="childList")for(const o of r.addedNodes)o.tagName==="LINK"&&o.rel==="modulepreload"&&i(o)}).observe(document,{childList:!0,subtree:!0});function s(e){const r={};return e.integrity&&(r.integrity=e.integrity),e.referrerPolicy&&(r.referrerPolicy=e.referrerPolicy),e.crossOrigin==="use-credentials"?r.credentials="include":e.crossOrigin==="anonymous"?r.credentials="omit":r.credentials="same-origin",r}function i(e){if(e.ep)return;e.ep=!0;const r=s(e);fetch(e.href,r)}})();
+import"./app-DBsNB-2y.js";(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.supports("modulepreload"))return;for(const e of document.querySelectorAll('link[rel="modulepreload"]'))i(e);new MutationObserver(e=>{for(const r of e)if(r.type==="childList")for(const o of r.addedNodes)o.tagName==="LINK"&&o.rel==="modulepreload"&&i(o)}).observe(document,{childList:!0,subtree:!0});function s(e){const r={};return e.integrity&&(r.integrity=e.integrity),e.referrerPolicy&&(r.referrerPolicy=e.referrerPolicy),e.crossOrigin==="use-credentials"?r.credentials="include":e.crossOrigin==="anonymous"?r.credentials="omit":r.credentials="same-origin",r}function i(e){if(e.ep)return;e.ep=!0;const r=s(e);fetch(e.href,r)}})();

package/dist/web/index.html

@@ -77,9 +77,9 @@
         document.documentElement.setAttribute("data-density", density === "tightest" || density === "tighter" || density === "compact" || density === "comfortable" ? density : "default");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-CzIBjYsB.js"></script>
-    <link rel="modulepreload" crossorigin href="/assets/app-ByCusSHX.js">
-    <link rel="stylesheet" crossorigin href="/assets/app-DsHSufBt.css">
+    <script type="module" crossorigin src="/assets/index-Ch4ks76J.js"></script>
+    <link rel="modulepreload" crossorigin href="/assets/app-DBsNB-2y.js">
+    <link rel="stylesheet" crossorigin href="/assets/app-BiJ8TfUl.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.43.1",
+  "version": "3.43.4",
   "description": "Local dashboard for Claude Code and Codex CLI sessions: which Claude Code session needs input, every tool call and Claude Code subagent live, token cost and quota, several Claude accounts. Run npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -77,7 +77,14 @@
     "3.39.4",
     "3.40.1",
     "3.41.3",
-    "3.43.1"
+    "3.43.1",
+    "3.43.3"
+  ],
+  "3.43.4": [
+    {
+      "title": "🔐 Local network no longer sends the login a deck is signed in to",
+      "body": "Two machines on one Claude login race to renew it, and the one that renews second is signed out with “Login expired”. So paired decks no longer receive the login a deck is signed in to right now. Every other login you tick is shared as before, and this one goes out once the deck switches to another account.\n\nUpdate every paired deck: an older deck still sends the login it is using, and the decks paired with it still take it. To send it anyway, as before, turn on Send the login this deck is using too in the Local network dialog. Not covered yet: a paired deck that already holds a copy of that login, from before this deck switched to it, can still renew it first and sign this deck out. Auto-switch can also still move a deck onto a login another paired deck is using, if the deck already holds a copy of it."
+    }
   ],
   "3.43.0": [
     {

package/src/server/account-choice.mjs

@@ -95,7 +95,7 @@ export function readingCurrent(account, models, now) {
 
 /**
  * Whether Auto-switch may land on this account: signed in, in rotation, not
- * the one another paired deck is working on, not one claude-swap has
+ * reserved by a local `cswap run` session, not one claude-swap has
  * quarantined, read recently, and comfortably under the threshold on every
  * window that counts. An account with no 5-hour or weekly window (an API key)
  * is never a target here; the engine still decides about those.
@@ -140,11 +140,12 @@ function soonestWeekly(accounts, ctx, before = null) {
  *             somebody just set a home and expects to be taken there.
  *   threshold the engine's, in percent
  *   models    countedModels(...) of the engine's model setting
- *   busy      keys of the accounts whose login is live somewhere else: on a
- *             paired deck, or in a `cswap run` session
+ *   busy      keys of accounts reserved by local `cswap run` sessions;
+ *             activity reported by other paired devices does not exclude them
  *   quarantined keys of the accounts claude-swap's engine has quarantined
  *   sinceMove ms since the last move, the engine's or this one's
- *   cooldownMs the engine's cooldown, which every move here keeps too
+ *   cooldownMs the engine's cooldown for proactive moves; fully exhausted
+ *             windows can be escaped immediately
  *   optional  whether moves below the threshold may be made at all: only
  *             while the engine itself is on `best`
  *
@@ -154,7 +155,7 @@ export function chooseAccount({ accounts, choice, threshold, models = [], busy =
   const next = choice?.next === "weekly" ? "weekly" : "room";
   const homeKey = choice?.home ?? null;
   if (next === "room" && !homeKey) return null;
-  if (sinceMove < cooldownMs || !Number.isFinite(threshold)) return null;
+  if (!Number.isFinite(threshold)) return null;
 
   const active = accounts.find(a => a.active);
   // The engine reads the account it is on every minute or so; if the store
@@ -162,6 +163,9 @@ export function chooseAccount({ accounts, choice, threshold, models = [], busy =
   if (!active || !readingCurrent(active, models, now)) return null;
   const used = usedOf(active, models);
   if (used == null) return null;
+  // Like the engine, an exhausted window must be escapable immediately.
+  // Ordinary threshold moves and optional returns still keep the cooldown.
+  if (sinceMove < cooldownMs && used < 100) return null;
 
   const ctx = { threshold, models, busy, quarantined, now };
   const home = homeKey ? accounts.find(a => a.key === homeKey) ?? null : null;

package/src/server/cswap-auto-choice.mjs

@@ -30,7 +30,7 @@ import { backupRoot, fetchClaudeAccounts, slotNumber, switchClaudeAccount } from
 import { readCswapConfig } from "./cswap-auto-readers.mjs";
 import { accountKey } from "./lan-copies.mjs";
 import { isProcessAlive } from "./deck-probe.mjs";
-import { chooseAccount, countedModels, NEXT_CHOICES } from "./account-choice.mjs";
+import { chooseAccount, countedModels, readingCurrent, NEXT_CHOICES } from "./account-choice.mjs";
 
 /** Where the choice is kept: beside prefs.json, in the deck's own data. */
 export function choicePath(home = deckDataDir()) {
@@ -146,26 +146,6 @@ async function engineState(accounts) {
   };
 }
 
-/** The accounts paired decks have recently said they are working on.
- *  One login live on two machines races for every renewal (README, "One login
- *  live in one place"), so a tick never moves onto one of them. The LAN table
- *  retains old manifests for display after a peer goes quiet; those are not
- *  current reservations. Use the authenticated manifest's receipt time, not a
- *  beacon or a failed round, which cannot confirm the account still in use. */
-async function accountsOnOtherDecks(now) {
-  try {
-    const [{ lanEngine }, { PRESENT_MS }] = await Promise.all([
-      import("./lan-deck.mjs"), import("./lan-sync.mjs"),
-    ]);
-    const peers = lanEngine.status()?.peers ?? [];
-    return new Set(peers
-      .filter(p => p?.paired === true && Number.isFinite(p.offers?.at) && p.offers.at > 0 && now - p.offers.at < PRESENT_MS)
-      .map(p => p.offers.current?.key).filter(k => typeof k === "string"));
-  } catch {
-    return new Set();
-  }
-}
-
 /** The name claude-swap gives an account's `cswap run` profile after its
  *  slot number: the email, NFC, with anything but ASCII letters, digits and
  *  `._-` turned into `_` (claude_swap/session.py, slugify_email). */
@@ -219,7 +199,7 @@ const refOf = a => (a ? { number: a.num, email: a.email ?? null } : null);
  * roster it decided on, which noteEngineTick needs to name where the engine
  * went, and null when nothing is set.
  */
-export async function chooseBeforeEngine({ now = Date.now() } = {}) {
+export async function chooseBeforeEngine({ now = Date.now(), refreshHome = true } = {}) {
   const choice = await readChoice();
   if (choice.next === "room" && !choice.home) return { result: null, accounts: null };
   const roster = await fetchClaudeAccounts();
@@ -244,26 +224,39 @@ export async function chooseBeforeEngine({ now = Date.now() } = {}) {
   const threshold = numberOr(cfg["autoswitch.threshold"]?.value, 90);
   const models = countedModels(cfg["autoswitch.model"]?.value);
   const engine = await engineState(accounts);
+  const lastMoveAt = Math.max(choice.lastMoveAt, engine.lastSwitchAt);
+  const cooldownMs = numberOr(cfg["autoswitch.cooldownSeconds"]?.value, 300) * 1000;
+  const cooldownUntil = lastMoveAt + cooldownMs;
   const pick = chooseAccount({
     accounts,
     choice: { next: choice.next, home: choice.home?.key ?? null, manual, goHome },
     threshold,
     models,
-    busy: new Set([...await accountsOnOtherDecks(now), ...await accountsInCswapRun(accounts)]),
+    busy: await accountsInCswapRun(accounts),
     quarantined: engine.quarantined,
-    sinceMove: now - Math.max(choice.lastMoveAt, engine.lastSwitchAt),
-    cooldownMs: numberOr(cfg["autoswitch.cooldownSeconds"]?.value, 300) * 1000,
+    sinceMove: now - lastMoveAt,
+    cooldownMs,
     optional: (cfg["autoswitch.strategy"]?.value ?? "best") === "best",
     now,
   });
   if (!pick) {
     await updateChoice(keep);
-    return { result: null, accounts };
+    return { result: null, accounts, cooldownUntil };
+  }
+  // Give Home one collection pass before a fresh weekly candidate can
+  // preempt it. The loop retries with refreshHome=false after its dry run:
+  // a failed/backed-off collection must not prevent leaving a full account.
+  const home = choice.home ? accounts.find(a => a.key === choice.home.key) : null;
+  if (refreshHome && pick.trigger !== "home" && home && !home.active &&
+      !home.disabled && home.alive !== false && !home.error && !home.reauth &&
+      !readingCurrent(home, models, now)) {
+    await updateChoice(keep);
+    return { result: null, accounts, cooldownUntil };
   }
   const moved = await switchClaudeAccount(pick.to.num);
   if (!moved.ok) {
     await updateChoice(keep);
-    return { result: null, accounts };
+    return { result: null, accounts, cooldownUntil };
   }
   // The move happened, so where it left the user and when are true whatever
   // was set meanwhile; a home still to be gone to is the current choice's.

package/src/server/cswap-auto-loop.mjs

@@ -116,8 +116,20 @@ async function runAutoTick() {
       if (!_enabled) return { skipped: "disabled" };
       if (await externalAutoRunning()) return { skipped: "external-engine" };
       invalidateClaudeAccountsCache();
-      chose = await chooseBeforeEngine().catch(() => ({ result: null, accounts: null }));
+      chose = await chooseBeforeEngine({ refreshHome: false }).catch(() => ({ result: null, accounts: null }));
       if (chose.result) return { chose: chose.result };
+      // A deck-managed `cswap switch` does not advance the engine's own
+      // lastSwitchAt. Its fallback must keep our cooldown too, or a manual
+      // return to the full account can immediately escape the weekly rule
+      // through the engine's most-room choice. Still allow emergency exits.
+      const decision = summarise(preview.stdout);
+      if (Date.now() < chose.cooldownUntil && decision.trigger !== "at-limit" && decision.trigger !== "failover") {
+        return { chose: {
+          ok: true, ...decision, event: "no-switch", switched: false,
+          trigger: null, reason: "cooldown", from: null, to: null,
+          detail: "Waiting for the account-switch cooldown",
+        } };
+      }
     }
     const out = await run(await cswapBin(), ["auto", "--once", "--json"], { timeout: TICK_TIMEOUT_MS });
     return { ...out, accounts: chose.accounts };

package/src/server/deck-prefs.mjs

@@ -158,6 +158,16 @@ export const DEFAULTS = Object.freeze({
     // of one person's machines show each other where they are working; off, and
     // paired decks read "current account hidden" instead.
     shareActive: true,
+    // THE LOGIN THIS DECK IS USING, SENT TO A PAIRED DECK, off unless somebody
+    // turns it on (#2192). A ticked account goes to every paired deck that
+    // lacks it or holds an expired copy — and when it is the one this deck is
+    // signed in to, the two machines then hold one login. A Claude login renews
+    // once: whichever copy renews it first keeps it, and the other machine is
+    // signed out. So while this deck is on an account, that account stays
+    // here, and goes out like any other the moment this deck switches away. A
+    // new field, so nobody's saved choice is changed: the ticks are untouched,
+    // and what they hand out is every login except the one in use.
+    sendInUse: false,
     // FINDING THIS PERSON'S OTHER MACHINES OVER TAILSCALE, off until they turn
     // it on: it is a new path off this machine, and the owner chooses it. Its
     // two permissions ship on, like the local pair above, and they are narrower
@@ -298,6 +308,9 @@ function normaliseLan(raw) {
     // Whether paired decks are told which shared account this one is on. Absent
     // is on — the default above — and only a real boolean turns it off.
     shareActive: flagOr(src.shareActive, DEFAULTS.lan.shareActive),
+    // Whether the login in use here may be sent. Off unless a real boolean
+    // says on.
+    sendInUse: flagOr(src.sendInUse, DEFAULTS.lan.sendInUse),
     // The Tailscale switch and its two permissions. Only a real boolean
     // overrides a default, as above.
     tailscale: flagOr(src.tailscale, DEFAULTS.lan.tailscale),
@@ -707,7 +720,7 @@ export function publicPrefs(prefs) {
 export const PAGE_FIELDS = Object.freeze({
   top: Object.freeze(["notifications", "notifySwap", "notifyQuota", "notifyReset", "tourSeen", "autoUpdate", "recoverCodexSessions", "recoverClaudeSessions"]),
   lan: Object.freeze([
-    "enabled", "name", "shared", "manual", "shareActive", "pairingMode",
+    "enabled", "name", "shared", "manual", "shareActive", "sendInUse", "pairingMode",
     "autoAsk", "autoAccept", "tailscale", "tailscaleAsk", "tailscaleAccept",
   ]),
 });

package/src/server/lan-copies.mjs

@@ -135,19 +135,52 @@ export function slotFor(accounts, key) {
  * manifest entirely — not listed as withheld, which would tell the group that
  * an account exists and is being kept back, and that is itself the fact being
  * kept back.
+ *
+ * THE ONE THIS DECK IS ON IS LISTED AND NOT GIVEN, unless `sendInUse` says to
+ * (#2192). A Claude login renews once: the copy that renews it first keeps it,
+ * and every other copy is refused from then on — so a peer handed the login
+ * this deck is signed in to holds the same expiry, reaches for the same renewal,
+ * and one of the two machines is signed out ("Login expired · Please run
+ * /login"). The row stays in the list, because it is what `current` names and a
+ * paired deck keeps a `current` only for an account in the same list (see
+ * heardCurrent) — which is how the other deck knows this one is on it. It goes
+ * as `shareable: false`, which every peer since 3.29.0 already reads as "do not
+ * ask", and `inUse`, which a peer of this version reads as why. An older peer
+ * that asks anyway is refused by `serve` (lan-serve.mjs) with "in use".
+ *
+ * NOT LISTED AT ALL WHILE ITS OWNER HIDES WHICH ACCOUNT THIS DECK IS ON
+ * (`shareActive` false). Then `current` names nothing, so the row has no reason
+ * to be there, and it would say exactly what the switch keeps back: `inUse`
+ * names it, and even a bare `shareable: false` on the one ticked login that
+ * works here points at it. Left out, it reads as a login not ticked — the
+ * fact this list already keeps back (see `shared` above) — and it is still
+ * never sent: nobody asks for a login that is not listed, and `serve` refuses
+ * one that is asked for anyway, in the words it refuses an unticked one.
  */
-export function manifestFor(accounts, shared) {
+export function manifestFor(accounts, shared, { sendInUse = false, shareActive } = {}) {
   const want = new Set(shared);
-  return onePerKey(accounts.filter(a => want.has(a.key)))
+  // Which identity is live here, whichever of its slots onePerKey picks: two
+  // slots for one login are one login.
+  const live = new Set(sendInUse ? [] : accounts.filter(a => a.active).map(a => a.key));
+  const hidden = shareActive === false;
+  return onePerKey(accounts.filter(a => want.has(a.key) && !(hidden && live.has(a.key))))
     .map(a => ({
       key: a.key,
       email: a.email,
       alive: !!a.alive,
-      ...(a.readable === false ? { shareable: false } : {}),
+      ...(a.readable === false || live.has(a.key) ? { shareable: false } : {}),
+      ...(live.has(a.key) ? { inUse: true } : {}),
     }))
     .sort((a, b) => a.key.localeCompare(b.key));
 }
 
+/** Whether a peer that asks may be handed this identity now: every one but the
+ *  one this deck is on, unless the owner chose to send that too — the same
+ *  rule manifestFor lists by, checked again at the moment of sending. */
+export function mayGiveInUse(accounts, key, sendInUse) {
+  return sendInUse === true || !accounts.some(a => a.key === key && a.active);
+}
+
 /**
  * Which account this deck is on, as a frame field for the decks it is paired
  * with — or nothing.
@@ -201,6 +234,9 @@ export function offered(list) {
       alive: storedCopyAlive(a.alive, a.collector),
       // Additive wire field: an older peer omitted it, which means shareable.
       ...(a.shareable === false ? { shareable: false } : {}),
+      // Additive too (#2192): that deck is on this login and keeps it there.
+      // Only beside `shareable: false`, which is what stops a round asking.
+      ...(a.shareable === false && a.inUse === true ? { inUse: true } : {}),
     }))
     .filter(a => a.key && a.email))
     // Fifty IDENTITIES, so the cap is spent after onePerKey rather than before
@@ -238,8 +274,10 @@ export const SENDER_UNREADABLE = "keychain_unavailable";
 
 /** The reasons `serve` gives for a login it will not send. Its other answer to
  *  a `want`, "not paired", is not in the set, so a deck that gets it records
- *  "refused". */
-const WIRE_REFUSALS = new Set(["proof", "not shared", "not mine to give", "export failed", SENDER_UNREADABLE, "error"]);
+ *  "refused". "in use" is the sending deck being on that login itself (#2192);
+ *  a deck older than that records it as "refused", which is all it proves. */
+export const IN_USE = "in use";
+const WIRE_REFUSALS = new Set(["proof", "not shared", "not mine to give", "export failed", SENDER_UNREADABLE, IN_USE, "error"]);
 
 /**
  * A peer's refusal, as this deck records it. The panel prints these, so a peer

package/src/server/lan-deck.mjs

@@ -352,6 +352,9 @@ export function lanApplyFields(prefs, { load = false, env = process.env } = {})
     pairingMode: lan.pairingMode === "invite" ? "invite" : "automatic",
     // Whether paired decks are told which shared account this one is on.
     shareActive: lan.shareActive !== false,
+    // Whether the account this deck is using right now may be sent to a paired
+    // deck. Off unless somebody turned it on (#2192).
+    sendInUse: lan.sendInUse === true,
     // Discovery over Tailscale, off unless somebody turned it on, and the two
     // permissions that answer for the owner's own machines there.
     tailscale: lan.tailscale === true,

package/src/server/lan-engine.mjs

@@ -307,6 +307,9 @@ export function createEngine({
     autoAsk: true, autoAccept: true, pairingMode: "automatic", aliases: {},
     // Tell paired decks which shared account this one is on — see currentFor.
     shareActive: true,
+    // Send the account this deck is on to a paired deck that asks — off, so
+    // one login is live in one place (#2192). See manifestFor and lan-serve.mjs.
+    sendInUse: false,
     // DISCOVERY OVER TAILSCALE, off until somebody turns it on, and its own
     // pair of permissions. They are separate from the two above because the
     // tailnet is a different audience: the local switches answer for whoever
@@ -1474,6 +1477,8 @@ export function createEngine({
         pairingMode: cfg.pairingMode === "invite" ? "invite" : "automatic",
         // Whether paired decks are told which shared account this one is on.
         shareActive: cfg.shareActive !== false,
+        // Whether the account this deck is on may be sent to one (#2192).
+        sendInUse: cfg.sendInUse === true,
         // Discovery over Tailscale: whether this machine has it at all, which
         // decides whether the dialog shows the switch, and what it can see.
         tailscale: tailnet ? tailnetStatus() : null,

package/src/server/lan-manifest.mjs

@@ -12,7 +12,7 @@ import { openAbout, sealAbout } from "./lan-about.mjs";
  * is the engine's clock. `myFp` answers this deck's fingerprint as it is at
  * the moment of asking — a restart for a new key changes it — and `settings`
  * the settings in force, of which a manifest reads `shared`, `onward`,
- * `trusted` and `shareActive`.
+ * `trusted`, `shareActive` and `sendInUse`.
  */
 export function createManifests({ about, now, myFp, settings }) {
   /** What each paired deck said about itself — version, operating system,
@@ -43,7 +43,7 @@ export function createManifests({ about, now, myFp, settings }) {
     const cfg = settings();
     const shared = sharedWith(cfg, toFp);
     return {
-      t: "manifest", accounts: manifestFor(accounts, shared),
+      t: "manifest", accounts: manifestFor(accounts, shared, { sendInUse: cfg.sendInUse === true, shareActive: cfg.shareActive }),
       ...currentFor(accounts, shared, cfg.shareActive),
       ...cardFor(key, toFp),
     };

package/src/server/lan-serve.mjs

@@ -5,7 +5,7 @@
 // answered at all. It keeps nothing of its own: every check reads the
 // engine's settings, listener and key at the moment it is made, because any
 // of them can change while the store is read.
-import { credentialAad, seal, sharedWith, slotFor, transferChallenge, trustedPeer } from "./lan-sync.mjs";
+import { credentialAad, IN_USE, mayGiveInUse, seal, sharedWith, slotFor, transferChallenge, trustedPeer } from "./lan-sync.mjs";
 import { liveLoginIs } from "./account-health.mjs";
 
 /**
@@ -62,7 +62,12 @@ export function createServe({
         // paired is less than everything ticked — see sharedWith.
         const maySend = () => settings().enabled && !!serverNow() && !!trustedPeer(settings().trusted, ctx.peerFp)
           && sharedWith(settings(), ctx.peerFp).includes(msg.key);
-        if (!maySend()) return ctx.send({ t: "no", why: "not shared" });
+        // ONE ORDER, WHATEVER IS ASKED FOR: the proof, then the store, then
+        // whether that deck may have it (#2192). While its owner hides which
+        // account this deck is on, the login it is on is refused "not shared",
+        // as one not ticked is; refused before the proof and before the store,
+        // an unticked one answered a bad proof differently and sooner, which
+        // told the two apart.
         // A SECOND PROOF, for the one operation that moves a credential. The
         // session says who connected; this says they are asking for this
         // account, now. A long-lived connection authenticated an hour ago is
@@ -83,6 +88,16 @@ export function createServe({
         // live one behind it.
         const mine = slotFor(accounts, msg.key);
         if (!mine) return ctx.send({ t: "no", why: "not mine to give" });
+        // NOT THE LOGIN THIS DECK IS ON, unless its owner said so (#2192). The
+        // manifest already marked it not to be asked for, and a peer older than
+        // that mark asks anyway; this is the answer that does not depend on the
+        // asker's version, read off the same store read as everything below.
+        // While its owner hides which account this deck is on, the manifest
+        // leaves that login out, and the refusal is the one an unticked login
+        // gets: "in use" would name it.
+        if (!mayGiveInUse(accounts, msg.key, settings().sendInUse)) {
+          return ctx.send({ t: "no", why: settings().shareActive === false ? "not shared" : IN_USE });
+        }
         // A LOGIN THIS DECK CANNOT READ IS SAID SO, from state rather than from
         // a failed export: no subprocess, and nothing the CLI printed. The
         // asking deck prints it under the account, so the person learns which

package/src/server/lan-sync.mjs

@@ -123,8 +123,8 @@ export {
 // wire — see lan-copies.mjs. Re-exported, so what imports them from here still
 // does.
 export {
-  accountKey, currentFor, heardCurrent, manifestFor, offered, onePerKey, peerWhy, plan, slotFor, syncAction,
-  HERE, SENDER_UNREADABLE,
+  accountKey, currentFor, heardCurrent, manifestFor, mayGiveInUse, offered, onePerKey, peerWhy, plan, slotFor,
+  syncAction, HERE, IN_USE, SENDER_UNREADABLE,
 } from "./lan-copies.mjs";
 
 /** Marks a packet as ours before anything reads a field of it. Four bytes of

package/src/server/process-command.mjs

@@ -31,8 +31,11 @@ export const CMD_MAX = 180;
 const SECRET_FLAG =
   /(-{1,2}[\w.-]*(?:token|password|passwd|secret|api[-_]?key|apikey|auth|credential|bearer|cookie|session[-_]?id|private[-_]?key)[\w.-]*)(=|\s+)(\S+)/gi;
 // The shapes that are a secret on their own, with no flag in front of them.
+// GitHub's fine-grained tokens and GitLab's prefixed ones (personal, deploy,
+// runner, trigger…) too: `gh`, `glab`, git credential helpers and scripts put
+// them on a command line as readily as the classic `ghp_` ones.
 const BARE_SECRET =
-  /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{16,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{12,}|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,})/g;
+  /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|gl(?:pat|dt|rt|cbt|ptt|ft|imt|agent|oas|soat)-[A-Za-z0-9_.-]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{12,}|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,})/g;
 // user:password@host, in any URL. The password goes; the rest is a location.
 const URL_CREDENTIALS = /\b([a-z][a-z0-9+.-]*:\/\/[^\s:@/]+):[^\s@/]+@/gi;
 

package/src/server/reports.mjs

@@ -477,8 +477,14 @@ export function scrub(text, home = homedir(), root = PKG_ROOT) {
     .replace(new RegExp(ADDRESS_PATTERN, "g"), "<host>")
     .replace(new RegExp(HOST_PATTERN, "g"), "<host>")
     .replace(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, "<email>")
+    // An Authorization header's value, whatever its scheme carries — a token
+    // of 44 characters of base64, say, is short of the generic pattern below
+    // (found with #2178) — and an Atlassian API token, which always starts
+    // ATATT, at any length.
+    .replace(/\b(Bearer|Basic)\s+[A-Za-z0-9+/._~-]{12,}=*/g, "$1 <secret>")
+    .replace(/\bATATT[A-Za-z0-9+/_=-]{8,}/g, "<secret>")
     .replace(
-      /\b(?:sk-ant-[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abpr]-[A-Za-z0-9-]{10,}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|[A-Fa-f0-9]{40,}|[A-Za-z0-9+_=-]{48,})/g,
+      /\b(?:sk-ant-[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|gl(?:pat|dt|rt|cbt|ptt|ft|imt|agent|oas|soat)-[A-Za-z0-9_.-]{20,}|xox[abpr]-[A-Za-z0-9-]{10,}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|[A-Fa-f0-9]{40,}|[A-Za-z0-9+_=-]{48,})/g,
       "<secret>",
     );
 }

package/src/server/traffic-radar-wire.mjs

@@ -151,16 +151,17 @@ export function createWireCapture({ host, port, onExport, onResponse, onIssue, o
     const side = dst === host && dstPort === port ? 'out' : src === host && srcPort === port ? 'in' : null;
     if (!side) return;
     const key = side === 'out' ? `${src}:${srcPort}` : `${dst}:${dstPort}`;
-    for (const [k, f] of flows) if (at - f.at > 60_000) discard(k, 'idle_connection');
     let flow = flows.get(key);
     const syn = !!(t[13] & 2), ack = !!(t[13] & 16);
     if (syn && !ack) flows.delete(key);
     if (!flow || (syn && !ack)) {
       if (flows.size >= 16) discard(flows.keys().next().value, 'connection_limit');
-      flow = { key, at, ready: false, out: direction(), in: direction(), streams: new Map(), ignored: false };
+      flow = { key, ready: false, out: direction(), in: direction(), streams: new Map(), ignored: false };
       flows.set(key, flow);
     }
-    flow.at = at;
+    // Quiet HTTP/2 connections still need their preface and HPACK state for the
+    // next export. Bound retention by connection count, evicting the least used.
+    flows.delete(key); flows.set(key, flow);
     const size = (t[12] >> 4) * 4;
     if (size < 20 || size > t.length) { discard(key, 'capture_gap'); return; }
     const body = t.subarray(size), d = flow[side];