npm - agent-dag - Versions diffs - 1.33.0 → 1.33.2 - Mend

agent-dag 1.33.0 → 1.33.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/bin/agent-dag.js +112 -5
package/bin/deck.js +22 -7
package/dist/web/assets/{index-Disgmxp1.js → index-D4UiP6Xm.js} +16 -16
package/dist/web/index.html +1 -1
package/package.json +1 -1
package/src/server/index.mjs +31 -5
package/src/server/self-update.mjs +93 -9

package/dist/web/index.html CHANGED Viewed

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>agents-deck</title>
     <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'%3E%3Ctext y='84' font-size='84'%3E%E2%97%89%3C/text%3E%3C/svg%3E" />
-    <script type="module" crossorigin src="/assets/index-Disgmxp1.js"></script>
+    <script type="module" crossorigin src="/assets/index-D4UiP6Xm.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-hRjhJVfb.css">
   </head>
   <body>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "1.33.0",
+  "version": "1.33.2",
   "description": "Live deck of Claude Code and Codex agents — watch parallel subagents fork, call tools, and return on one calm canvas. Also available as npx ccdeck and npx agent-dag.",
   "type": "module",
   "bin": {

package/src/server/index.mjs CHANGED Viewed

@@ -938,7 +938,11 @@ async function serveStatic(req, res, url) {
     // SPA fallback to index.html for client-side routes
     try {
       const idx = await readFile(join(WEB_DIST, "index.html"));
-      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      // Same no-cache as the normal path above, which this used to omit. It
+      // matters more since the deck upgrades itself: index.html is the file
+      // naming the hashed bundle, so a heuristically-cached copy sends the tab
+      // back to the OLD assets after an update and the reload achieves nothing.
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-cache" });
       res.end(idx);
     } catch {
       send(res, 404, { error: "ui not built. run `pnpm build` or `npm run build`." });
@@ -1041,17 +1045,39 @@ async function handleUpgrade(_req, res) {
 // Restart is a two-party act: this half answers before it stops listening, so
 // the caller learns it was accepted rather than losing the socket mid-reply.
-function handleRestart(_req, res) {
+//
+// `{ upgrade: true }` asks for the npx variant: come back through
+// `npx -y <spec>@latest` instead of re-running the files already here. Granted
+// only where that is genuinely how this copy updates — the mode is decided from
+// the install on disk, never from the request.
+async function handleRestart(req, res) {
   if (!_onRestart) return send(res, 501, { ok: false, reason: "unsupervised" });
   // Enforced here and not only in the UI. Under --no-persist a restart destroys
   // the whole canvas — replayLog has no file to read — and a destructive act
   // must not be prevented by a hidden button alone.
   if (!_canRestart) return send(res, 409, { ok: false, reason: "no_persist" });
+  let wantUpgrade = false;
+  if (req.method === "POST") {
+    const body = await readBody(req).catch(() => null);
+    try { wantUpgrade = JSON.parse(body ?? "")?.upgrade === true; } catch { /* a plain restart */ }
+  }
+  let mode = null;
+  if (wantUpgrade) {
+    const { upgradeBlock, upgradeMode, npxRestartSpec } = await import(
+      pathToFileURL(join(PKG_ROOT, "src/server/self-update.mjs")).href
+    );
+    if (upgradeMode(upgradeBlock(PKG_ROOT)) !== "npx" || !npxRestartSpec(PKG_ROOT)) {
+      return send(res, 409, { ok: false, reason: "not_npx" });
+    }
+    mode = "npx";
+  }
   if (_restarting) return send(res, 202, { ok: true, already: true });
   _restarting = true;
-  send(res, 200, { ok: true });
+  send(res, 200, { ok: true, mode });
   // Let the response flush before the listener goes away.
-  setTimeout(() => { try { _onRestart(); } catch { _restarting = false; } }, 120).unref();
+  setTimeout(() => { try { _onRestart(mode); } catch { _restarting = false; } }, 120).unref();
 }
 async function handleQuota(req, res) {
@@ -1311,7 +1337,7 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
     if (req.method === "GET"  && url.pathname === "/events")     return handleSse(req, res);
     if (req.method === "GET"  && url.pathname === "/api/version")     return guard(handleVersion(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/upgrade")     return guard(handleUpgrade(req, res), res);
-    if (req.method === "POST" && url.pathname === "/api/restart")     return handleRestart(req, res);
+    if (req.method === "POST" && url.pathname === "/api/restart")     return guard(handleRestart(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/quota")       return guard(handleQuota(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/codex-usage")  return guard(handleCodexUsage(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/codex-quota") return guard(handleCodexQuota(req, res), res);

package/src/server/self-update.mjs CHANGED Viewed

@@ -83,9 +83,66 @@ export function isGitCheckout(pkgRoot) {
   try { return existsSync(join(pkgRoot, ".git")); } catch { return false; }
 }
-/** The exact line the user can paste. */
+// ── npx ──────────────────────────────────────────────────────────────────────
+//
+// An npx run lives in ~/.npm/_npx/<hash>/node_modules/<pkg>. The hash is over
+// the SPEC the user typed, so upgrading means fetching a different directory —
+// there is nothing to install over. What there IS, is the spec itself: npm
+// writes it into <hash>/package.json as `_npx.packages`, which is the only
+// record of whether the user typed `ccdeck`, `agent-dag` or `agents-deck`.
+// Re-running the wrong one would work but would leave them on a package they
+// never asked for, so it is worth reading rather than guessing.
+/** The `_npx/<hash>` directory this package was unpacked into, or null. Pure —
+ *  path arithmetic only, so both platforms' separators can be tested. */
+export function npxRoot(pkgRoot) {
+  if (typeof pkgRoot !== "string") return null;
+  const parts = pkgRoot.split(/[\\/]/);
+  const i = parts.lastIndexOf("_npx");
+  if (i === -1 || i + 1 >= parts.length) return null;
+  // Keep the separator the input used: a Windows path must come back as one.
+  const sep = pkgRoot.includes("\\") && !pkgRoot.includes("/") ? "\\" : "/";
+  return parts.slice(0, i + 2).join(sep);
+}
+/** Package name out of an npm spec, scope intact: `ccdeck@1.2.3` → `ccdeck`,
+ *  `@scope/pkg` → `@scope/pkg`. Null for anything that is not a plain name —
+ *  a tarball URL or a git spec is not something to re-run with `@latest`. */
+export function bareSpecName(spec) {
+  if (typeof spec !== "string") return null;
+  const s = spec.trim();
+  if (!s) return null;
+  const at = s.lastIndexOf("@");
+  const name = at > 0 ? s.slice(0, at) : s;
+  return /^@?[a-z0-9][a-z0-9._-]*(\/[a-z0-9][a-z0-9._-]*)?$/i.test(name) ? name : null;
+}
+/** What to hand `npx -y`, read from the cache directory's own metadata. */
+export function npxSpecFromMeta(meta, fallback = "agents-deck") {
+  const list = meta && meta._npx && Array.isArray(meta._npx.packages) ? meta._npx.packages : [];
+  for (const entry of list) {
+    const name = bareSpecName(entry);
+    if (name) return `${name}@latest`;
+  }
+  return `${fallback}@latest`;
+}
+/** The same, answered against the filesystem. Null when this is not an npx run. */
+export function npxRestartSpec(pkgRoot, name = "agents-deck") {
+  const root = npxRoot(pkgRoot);
+  if (!root) return null;
+  let meta = null;
+  try { meta = JSON.parse(readFileSync(join(root, "package.json"), "utf8")); } catch { /* fall back to the name */ }
+  return npxSpecFromMeta(meta, name);
+}
+/** The exact line the user can paste, for the way THIS copy was installed. */
 export function upgradeCommand(pkgRoot, name = "agents-deck") {
-  return isNpxInstall(pkgRoot) ? `npx -y ${name}@latest` : `npm i -g ${name}@latest`;
+  // A checkout is updated by pulling, and the bundle is built, not shipped —
+  // so `npm run build` is part of the answer rather than an afterthought.
+  if (isGitCheckout(pkgRoot)) return "git pull && npm run build";
+  if (isNpxInstall(pkgRoot)) return `npx -y ${npxRestartSpec(pkgRoot, name) ?? `${name}@latest`}`;
+  return `npm i -g ${name}@latest`;
 }
 // ── what npm has ─────────────────────────────────────────────────────────────
@@ -188,6 +245,23 @@ export function upgradeBlockedReason({ git, npx, writable, optedOut }) {
   return null;
 }
+/**
+ * How this copy can update itself, if it can at all.
+ *
+ *   "install" — `npm i -g` here and restart into the new files.
+ *   "npx"     — nothing to install: the supervisor re-runs `npx -y <spec>`,
+ *               which fetches a NEW cache directory and hands the port to it.
+ *   null      — a checkout, an unwritable prefix, or an explicit opt-out; the
+ *               user gets the command and does it themselves.
+ *
+ * Pure, so the policy is one readable expression rather than three conditions
+ * spread across the server and the UI.
+ */
+export function upgradeMode(blockedReason) {
+  if (blockedReason === null || blockedReason === undefined) return "install";
+  return blockedReason === "npx" ? "npx" : null;
+}
 function dirWritable(p) {
   try { accessSync(p, FS.W_OK); return true; } catch { return false; }
 }
@@ -278,13 +352,21 @@ export function lastMeaningfulLine(text) {
  *  registry is unreachable. */
 export async function versionReport({ running, pkgRoot, name = "agents-deck", now = Date.now() }) {
   const installed = installedVersion(pkgRoot);
-  // A checkout has no meaningful "latest", and an opt-out means no egress at
-  // all. Both keep the running-vs-installed half, which is purely local.
+  // Only an explicit opt-out silences the registry.
+  //
+  // A checkout used to be excluded here too, on the reasoning that its version
+  // leads npm's. That reasoning holds for the COMMAND — telling someone to
+  // `npm i -g` over their working copy is wrong — but not for the question.
+  // Knowing a release shipped is useful however you would install it, and
+  // suppressing the lookup meant `latest` was always null, so the upgrade
+  // notice could never appear and the "this is a checkout" explanation had
+  // nowhere to render. A checkout that is ahead of npm still says nothing:
+  // isOlder decides that, not this.
   const skipRegistry =
     process.env.AGENTS_DECK_NO_UPDATE_CHECK === "1" ||
-    process.env.AGENTS_DECK_NO_INSTALL === "1" ||
-    isGitCheckout(pkgRoot);
+    process.env.AGENTS_DECK_NO_INSTALL === "1";
   const latest = skipRegistry ? null : await latestOnNpm(name, now);
+  const blocked = upgradeBlock(pkgRoot);
   return {
     name,
     running: running ?? null,
@@ -292,9 +374,11 @@ export async function versionReport({ running, pkgRoot, name = "agents-deck", no
     latest,
     notice: pickNotice({ running, installed, latest }),
     command: upgradeCommand(pkgRoot, name),
-    // Why the Update button is absent, when it is — so the UI can say so
-    // instead of leaving a gap the user has to guess about.
-    upgradeBlocked: upgradeBlock(pkgRoot),
+    // Why an in-app `npm i -g` is refused, when it is — so the UI can say so
+    // instead of leaving a gap the user has to guess about. "npx" is a refusal
+    // of the install, not of the update: upgradeMode says so.
+    upgradeBlocked: blocked,
+    upgradeMode: upgradeMode(blocked),
     upgrade: upgradeStatus(),
   };
 }