@taewooopark/agent-blackbox 0.46.0 → 0.46.2

package/dist/agent-blackbox.plugin.mjs

@@ -433,6 +433,7 @@ function normalizeToolBefore(input, output, context) {
   const agentId = extractAgentId(input);
   if (agentId) {
     traceInput.agentId = agentId;
+    traceInput.agentRole = extractAgentRole(input);
   }
   return createTraceEvent(context.seq, traceInput);
 }
@@ -466,6 +467,7 @@ function normalizeToolAfter(input, output, context) {
     const agentId = extractAgentId(input);
     if (agentId) {
       traceInput.agentId = agentId;
+      traceInput.agentRole = extractAgentRole(input);
     }
   }
   return createTraceEvent(context.seq, traceInput);
@@ -850,9 +852,25 @@ function serializeTraceEvent(event) {
   return `${JSON.stringify(event)}
 `;
 }
+var writeChains = /* @__PURE__ */ new Map();
 async function appendTraceEvent(filePath, event) {
-  await mkdir(dirname(filePath), { recursive: true });
-  await appendFile(filePath, serializeTraceEvent(event), "utf8");
+  const line = serializeTraceEvent(event);
+  const run = async () => {
+    await mkdir(dirname(filePath), { recursive: true });
+    await appendFile(filePath, line, "utf8");
+  };
+  const prev = writeChains.get(filePath) ?? Promise.resolve();
+  const next = prev.then(run, run);
+  const tail = next.then(
+    () => void 0,
+    () => void 0
+  );
+  writeChains.set(filePath, tail);
+  try {
+    await next;
+  } finally {
+    if (writeChains.get(filePath) === tail) writeChains.delete(filePath);
+  }
 }
 
 // packages/opencode-adapter/dist/sink.js

package/dist/cli.js

@@ -1236,9 +1236,25 @@ function parseTraceEvents(input) {
   }
   return events;
 }
+var writeChains = /* @__PURE__ */ new Map();
 async function appendTraceEvent(filePath, event) {
-  await mkdir(dirname(filePath), { recursive: true });
-  await appendFile(filePath, serializeTraceEvent(event), "utf8");
+  const line = serializeTraceEvent(event);
+  const run = async () => {
+    await mkdir(dirname(filePath), { recursive: true });
+    await appendFile(filePath, line, "utf8");
+  };
+  const prev = writeChains.get(filePath) ?? Promise.resolve();
+  const next = prev.then(run, run);
+  const tail = next.then(
+    () => void 0,
+    () => void 0
+  );
+  writeChains.set(filePath, tail);
+  try {
+    await next;
+  } finally {
+    if (writeChains.get(filePath) === tail) writeChains.delete(filePath);
+  }
 }
 async function readTraceEvents(filePath) {
   const input = await readFile2(filePath, "utf8");
@@ -1252,7 +1268,7 @@ import { WebSocket, WebSocketServer } from "ws";
 
 // apps/daemon/dist/optimize.js
 import { mkdir as mkdir2, readFile as readFile3, rm, writeFile } from "node:fs/promises";
-import { dirname as dirname2, join as join2 } from "node:path";
+import { dirname as dirname2, isAbsolute, join as join2 } from "node:path";
 var flaggedIds = (report) => report.metrics.filter((m) => m.status !== "good").map((m) => m.id);
 var joinIds = (ids) => ids.join(", ");
 var REVERT_MARGIN = 3;
@@ -1265,7 +1281,8 @@ async function computeOptimize(options) {
   const eventsFile = options.eventsFile ?? join2(options.projectDir, ".agent-blackbox", "events.ndjson");
   const events = await loadTraceEvents(eventsFile);
   const { runId, events: runEvents } = latestRun(events);
-  const targetDir = runEvents.find((e) => typeof e.cwd === "string" && e.cwd.length > 0)?.cwd ?? options.projectDir;
+  const runCwd = runEvents.find((e) => typeof e.cwd === "string" && e.cwd.length > 0)?.cwd;
+  const targetDir = runCwd && isAbsolute(runCwd) ? runCwd : options.projectDir;
   const agentsMdPath = join2(targetDir, "AGENTS.md");
   const statePath = join2(targetDir, ".agent-blackbox", "optimization.json");
   const latestTs = runEvents.reduce((max, e) => e.ts > max ? e.ts : max, "");
@@ -1835,11 +1852,19 @@ async function buildTraceSnapshot(eventsFile, replay = {}) {
 }
 async function handleRequest(request, response, eventsFile, clients, suggestConfig, projectDir) {
   try {
+    applyCors(request, response);
     const url = new URL(request.url ?? "/", "http://127.0.0.1");
     if (request.method === "OPTIONS") {
       sendEmpty(response, 204);
       return;
     }
+    if (request.method === "POST") {
+      const origin = request.headers.origin;
+      if (typeof origin === "string" && !isLoopbackOrigin(origin)) {
+        sendJson(response, 403, { ok: false, error: { message: "cross-site request blocked" } });
+        return;
+      }
+    }
     const replay = parseReplayQuery(url);
     if (request.method === "GET" && url.pathname === "/health") {
       sendJson(response, 200, { ok: true, data: { status: "ok", eventsFile } });
@@ -1957,11 +1982,25 @@ async function readJsonBody(request) {
     throw new BadRequestError("Invalid JSON body");
   }
 }
+function applyCors(request, response) {
+  const origin = request.headers.origin;
+  if (typeof origin === "string" && isLoopbackOrigin(origin)) {
+    response.setHeader("access-control-allow-origin", origin);
+    response.setHeader("vary", "Origin");
+  }
+}
+function isLoopbackOrigin(origin) {
+  try {
+    const { hostname } = new URL(origin);
+    return hostname === "127.0.0.1" || hostname === "localhost" || hostname === "[::1]" || hostname === "::1";
+  } catch {
+    return false;
+  }
+}
 function sendJson(response, statusCode, payload) {
   response.writeHead(statusCode, {
     "access-control-allow-headers": "content-type",
     "access-control-allow-methods": "GET,POST,OPTIONS",
-    "access-control-allow-origin": "*",
     "content-type": "application/json; charset=utf-8"
   });
   response.end(JSON.stringify(payload));
@@ -1969,8 +2008,7 @@ function sendJson(response, statusCode, payload) {
 function sendEmpty(response, statusCode) {
   response.writeHead(statusCode, {
     "access-control-allow-headers": "content-type",
-    "access-control-allow-methods": "GET,POST,OPTIONS",
-    "access-control-allow-origin": "*"
+    "access-control-allow-methods": "GET,POST,OPTIONS"
   });
   response.end();
 }
@@ -2320,7 +2358,10 @@ function openInBrowser(url) {
   const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
   const args2 = platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    spawn2(command, args2, { stdio: "ignore", detached: true }).unref();
+    const child = spawn2(command, args2, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
   } catch {
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taewooopark/agent-blackbox",
-  "version": "0.46.0",
+  "version": "0.46.2",
   "description": "Local-first flight recorder + context-efficiency profiler for coding agents (OpenCode). Run with npx.",
   "type": "module",
   "license": "MIT",