agent-dag 1.33.1 → 1.33.3

package/dist/web/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>agents-deck</title>
     <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'%3E%3Ctext y='84' font-size='84'%3E%E2%97%89%3C/text%3E%3C/svg%3E" />
-    <script type="module" crossorigin src="/assets/index-BKz-oUzX.js"></script>
+    <script type="module" crossorigin src="/assets/index-VG3Xh-3i.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-hRjhJVfb.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "1.33.1",
+  "version": "1.33.3",
   "description": "Live deck of Claude Code and Codex agents — watch parallel subagents fork, call tools, and return on one calm canvas. Also available as npx ccdeck and npx agent-dag.",
   "type": "module",
   "bin": {

package/src/server/cswap-admin.mjs

@@ -19,8 +19,9 @@
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { run, runDetached, runInteractive } from "./exec.mjs";
+import { looksMissing, run, runDetached, runInteractive } from "./exec.mjs";
 import { invalidateClaudeAccountsCache } from "./claude-accounts.mjs";
+import { cswapBin } from "./cswap-install.mjs";
 
 // An OAuth code is short-lived at the source; there is no point holding a child
 // open longer than a user would plausibly take to fetch one.
@@ -65,9 +66,13 @@ export function withStoreLock(fn) {
 
 // ── shared helpers ───────────────────────────────────────────────────────────
 
-async function cswapBin() {
-  return process.env.AGENTS_DECK_CSWAP ?? "cswap";
-}
+// cswapBin comes from cswap-install.mjs, which searches the places uv and pipx
+// actually install to. This module used to answer the bare name "cswap"
+// instead, which is fine on a Mac where ~/.local/bin is usually on PATH and
+// wrong on Windows where it is usually not: every mutation here — share,
+// import, remove, rename, reorder — failed with cmd.exe's "is not recognized",
+// while the read-only half of the panel worked, because it was already using
+// the resolver. Reported from Windows on 2026-08-14.
 async function claudeBin() {
   return process.env.AGENTS_DECK_CLAUDE ?? "claude";
 }
@@ -224,7 +229,7 @@ export async function startLogin({ email } = {}) {
     if (flow !== _login) return;
     if (flow.state === "awaiting_url" || flow.state === "awaiting_code") {
       flow.state = "failed";
-      flow.error = r.timedOut ? "the sign-in window expired" : firstUseful(r.stderr || r.stdout) || "sign-in ended without a code";
+      flow.error = r.timedOut ? "the sign-in window expired" : failureText(r, "claude auth login") || "sign-in ended without a code";
     }
   });
 
@@ -274,7 +279,7 @@ export async function submitLoginCode(code) {
   }
   if (!r.ok) {
     flow.state = "failed";
-    flow.error = r.timedOut ? "the sign-in window expired" : firstUseful(r.stderr || r.stdout) || "the code was not accepted";
+    flow.error = r.timedOut ? "the sign-in window expired" : failureText(r, "claude auth login") || "the code was not accepted";
     return { ok: false, reason: "login_failed", ...loginState() };
   }
 
@@ -372,7 +377,7 @@ export async function shareAccount(num) {
   if (!Number.isInteger(n) || n < 1 || n > 999) return { ok: false, reason: "bad_account" };
   const r = await run(await cswapBin(), ["export", "-", "--account", String(n)], { timeout: CSWAP_TIMEOUT_MS });
   if (!r.ok || !r.stdout.trim()) {
-    return { ok: false, reason: "export_failed", detail: firstUseful(r.stderr || r.stdout) };
+    return { ok: false, reason: "export_failed", detail: failureText(r, "cswap export") };
   }
   return { ok: true, blob: wrapShare(r.stdout), expiresAt: Date.now() + SHARE_TTL_MS };
 }
@@ -390,7 +395,7 @@ export async function importAccount(blob) {
     endStdin(child);
 
     const r = await child.done;
-    if (!r.ok) return { ok: false, reason: "import_failed", detail: firstUseful(r.stderr || r.stdout) };
+    if (!r.ok) return { ok: false, reason: "import_failed", detail: failureText(r, "cswap import") };
 
     const after = await readStore();
     const slot = newSlot(before, after);
@@ -429,7 +434,7 @@ export async function removeAccount(num) {
     });
     const r = await child.done;
     invalidateClaudeAccountsCache();
-    if (!r.ok) return { ok: false, reason: "remove_failed", detail: firstUseful(r.stderr || r.stdout) };
+    if (!r.ok) return { ok: false, reason: "remove_failed", detail: failureText(r, "cswap remove") };
     // Exit 0 without the prompt means cswap declined for its own reason — a
     // live session on that account, most often — and printed why.
     if (!answered) return { ok: false, reason: "not_confirmed", detail: firstUseful(r.stdout || r.stderr) };
@@ -447,7 +452,7 @@ export async function setAlias(num, alias) {
     invalidateClaudeAccountsCache();
     return r.ok
       ? { ok: true, output: firstUseful(r.stdout) }
-      : { ok: false, reason: "alias_failed", detail: firstUseful(r.stderr || r.stdout) };
+      : { ok: false, reason: "alias_failed", detail: failureText(r, "cswap alias") };
   });
 }
 
@@ -460,12 +465,31 @@ export async function moveAccount(num, slot) {
     invalidateClaudeAccountsCache();
     return r.ok
       ? { ok: true, output: firstUseful(r.stdout) }
-      : { ok: false, reason: "move_failed", detail: firstUseful(r.stderr || r.stdout) };
+      : { ok: false, reason: "move_failed", detail: failureText(r, "cswap move") };
   });
 }
 
 // ── text ─────────────────────────────────────────────────────────────────────
 
+/**
+ * What went wrong, in a sentence the user can act on.
+ *
+ * The missing-tool case is singled out because its own output is useless: on
+ * Windows it is cmd.exe's two-line "is not recognized …/operable program or
+ * batch file.", and `firstUseful` — which takes the LAST line, correctly for
+ * every other CLI — leaves the second half on screen by itself.
+ */
+export function failureText(r, what = "cswap") {
+  const out = `${r?.stderr ?? ""}\n${r?.stdout ?? ""}`;
+  const tool = String(what).split(" ")[0];
+  if (r?.code === "ENOENT" || looksMissing(out)) {
+    return tool === "claude"
+      ? "the claude CLI could not be run: not on PATH. Set AGENTS_DECK_CLAUDE to its full path."
+      : "cswap could not be run: not on PATH, and not in the places uv and pipx install to. Set AGENTS_DECK_CSWAP to its full path.";
+  }
+  return firstUseful(out) || `${what} exited ${r?.code}`;
+}
+
 /** The line worth showing a user out of a CLI's output. */
 export function firstUseful(text) {
   const lines = stripTerminalEscapes(text)
@@ -488,7 +512,7 @@ export function addFailureText(r) {
   if (/keychain/i.test(text)) {
     return `${text} — start agents-deck from a Terminal window rather than a background service.`;
   }
-  return text || `cswap add exited ${r.code}`;
+  return failureText(r, "cswap add");
 }
 
 async function waitFor(get, timeoutMs, stepMs = 100) {

package/src/server/cswap-install.mjs

@@ -10,7 +10,7 @@
 import { run, runDetached } from "./exec.mjs";
 import { bootstrapUv, existingBootstrappedUv } from "./uv-bootstrap.mjs";
 import { existsSync, mkdirSync, statSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, posix as posixPath, win32 as winPath } from "node:path";
 import { homedir } from "node:os";
 
 const INSTALL_TIMEOUT_MS = 180_000; // uv resolves + builds a Python env
@@ -34,20 +34,49 @@ const MARKER = join(homedir(), ".agents-deck", ".cswap-update-check");
  * Re-resolved when a lookup fails so an install during this process is picked
  * up without a restart.
  */
+/**
+ * Every place an installer is known to leave cswap. Pure, and the platform is a
+ * parameter, so the Windows list can be checked from a Mac — which is the only
+ * way this list stays right, since it exists entirely for machines the author is
+ * not sitting at.
+ */
+export function cswapCandidates(platform = process.platform, env = process.env, home = homedir()) {
+  // The path flavour follows the PLATFORM ARGUMENT, not the host: node's `join`
+  // would emit forward slashes when this is exercised from a Mac, which is both
+  // wrong for the caller and invisible in a test.
+  const { join } = platform === "win32" ? winPath : posixPath;
+  const exe = platform === "win32" ? "cswap.exe" : "cswap";
+  const dirs = [];
+  // Explicit configuration first: someone who set these means them.
+  if (env.UV_TOOL_BIN_DIR) dirs.push(env.UV_TOOL_BIN_DIR);
+  if (env.XDG_BIN_HOME) dirs.push(env.XDG_BIN_HOME);
+  // Where `uv tool install` and `pipx install` put executables, everywhere.
+  dirs.push(join(home, ".local", "bin"));
+  if (platform === "win32") {
+    // pipx before 1.5, and any `pip install --user`. APPDATA is respected when
+    // set because a roaming profile moves it off the home directory.
+    dirs.push(join(env.APPDATA || join(home, "AppData", "Roaming"), "Python", "Scripts"));
+    dirs.push(join(env.LOCALAPPDATA || join(home, "AppData", "Local"), "Programs", "Python", "Scripts"));
+    dirs.push(join(home, "scoop", "shims"));
+  } else {
+    dirs.push(join(home, ".pyenv", "shims"));
+    // uv keeps the tool's own venv here and only symlinks into ~/.local/bin; if
+    // that link was never made, this is still a working executable.
+    dirs.push(join(home, ".local", "share", "uv", "tools", "claude-swap", "bin"));
+    dirs.push("/opt/homebrew/bin", "/usr/local/bin");
+  }
+  return dirs.map(d => join(d, exe));
+}
+
 let _bin = null;
 export async function cswapBin() {
+  // An explicit path wins over everything and is never cached away — someone
+  // debugging a bad resolution needs it to take effect immediately.
+  if (process.env.AGENTS_DECK_CSWAP) return process.env.AGENTS_DECK_CSWAP;
   if (_bin) return _bin;
   if ((await run("cswap", ["--version"], { timeout: 8_000 })).ok) return (_bin = "cswap");
 
-  const exe = process.platform === "win32" ? "cswap.exe" : "cswap";
-  const candidates = [
-    join(homedir(), ".local", "bin", exe),
-    // pipx before 1.5 on Windows, and any pip --user install.
-    process.platform === "win32"
-      ? join(homedir(), "AppData", "Roaming", "Python", "Scripts", exe)
-      : join(homedir(), ".pyenv", "shims", exe),
-  ];
-  for (const c of candidates) {
+  for (const c of cswapCandidates()) {
     if (existsSync(c) && (await run(c, ["--version"], { timeout: 8_000 })).ok) return (_bin = c);
   }
   return "cswap";   // not found; leave the bare name so errors read sensibly

package/src/server/exec.mjs

@@ -66,6 +66,26 @@ export const tryNext = (err) =>
   Boolean(err) && (err.code === "ENOENT" || err.code === "EACCES" ||
                    err.code === "EINVAL" || err.code === "UNKNOWN");
 
+/**
+ * cmd.exe's way of saying ENOENT.
+ *
+ * A .cmd or .bat candidate is launched THROUGH cmd.exe, and cmd.exe exists — so
+ * a missing tool is not a spawn error at all. It is a healthy shell exiting 1
+ * after printing two lines:
+ *
+ *     'cswap' is not recognized as an internal or external command,
+ *     operable program or batch file.
+ *
+ * Read as a real failure, that stops the candidate loop early AND puts the
+ * second line — on its own, meaningless — in front of the user. Reported from
+ * Windows on 2026-08-14: the accounts panel said only "operable program or
+ * batch file." when sharing an account.
+ */
+export const looksMissing = (text) =>
+  /is not recognized as an internal or external command/i.test(String(text ?? "")) ||
+  /operable program or batch file/i.test(String(text ?? "")) ||
+  /The system cannot find the (?:path|file) specified/i.test(String(text ?? ""));
+
 /**
  * Run a command and collect its output. Never rejects, and never throws —
  * failures come back as `{ ok: false }`, because every caller here is a poll or
@@ -86,11 +106,16 @@ export function run(cmd, args, { timeout = 20_000, maxBuffer = 4 << 20 } = {}) {
         : { file: raw, args, opts: {} };
 
       const done = (err, stdout, stderr) => {
-        if (err && tryNext(err) && i + 1 < tries.length) return attempt(i + 1);
+        // cmd.exe's "is not recognized" counts as "not this spelling" too, and
+        // it arrives as a normal non-zero exit rather than a spawn error.
+        const missing = Boolean(err) && looksMissing(`${stderr ?? ""}\n${stdout ?? ""}`);
+        if (err && (tryNext(err) || missing) && i + 1 < tries.length) return attempt(i + 1);
         if (!err) resolved.set(cmd, raw);
         resolve({
           ok: !err,
-          code: err?.code ?? 0,
+          // A tool cmd.exe could not find is missing, not "exited 1" — callers
+          // key their message off this.
+          code: missing ? "ENOENT" : (err?.code ?? 0),
           killed: Boolean(err?.killed),
           stdout: String(stdout ?? ""),
           stderr: String(stderr ?? ""),
@@ -191,7 +216,19 @@ export function runInteractive(cmd, args, { timeout = 300_000, maxOutput = 256 <
     const keep = (buf, text) => (buf + text).slice(-maxOutput);
     child.stdout?.on("data", (d) => { const t = String(d); stdout = keep(stdout, t); emitLines(t); });
     child.stderr?.on("data", (d) => { const t = String(d); stderr = keep(stderr, t); emitLines(t); });
-    child.on("close", (code) => finish(code ?? -1, null));
+    child.on("close", (code) => {
+      // Same cmd.exe case as in `run`: exit 1 with "is not recognized" means
+      // this spelling does not exist, not that the tool failed.
+      if (code !== 0 && looksMissing(`${stderr}\n${stdout}`)) {
+        if (i + 1 < tries.length) {
+          stdout = ""; stderr = ""; pending = "";
+          child = null;
+          return attempt(i + 1);
+        }
+        return finish(-1, { code: "ENOENT" });
+      }
+      finish(code ?? -1, null);
+    });
   };
   attempt(0);
 

package/src/server/index.mjs

@@ -938,7 +938,11 @@ async function serveStatic(req, res, url) {
     // SPA fallback to index.html for client-side routes
     try {
       const idx = await readFile(join(WEB_DIST, "index.html"));
-      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      // Same no-cache as the normal path above, which this used to omit. It
+      // matters more since the deck upgrades itself: index.html is the file
+      // naming the hashed bundle, so a heuristically-cached copy sends the tab
+      // back to the OLD assets after an update and the reload achieves nothing.
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-cache" });
       res.end(idx);
     } catch {
       send(res, 404, { error: "ui not built. run `pnpm build` or `npm run build`." });
@@ -1041,17 +1045,39 @@ async function handleUpgrade(_req, res) {
 
 // Restart is a two-party act: this half answers before it stops listening, so
 // the caller learns it was accepted rather than losing the socket mid-reply.
-function handleRestart(_req, res) {
+//
+// `{ upgrade: true }` asks for the npx variant: come back through
+// `npx -y <spec>@latest` instead of re-running the files already here. Granted
+// only where that is genuinely how this copy updates — the mode is decided from
+// the install on disk, never from the request.
+async function handleRestart(req, res) {
   if (!_onRestart) return send(res, 501, { ok: false, reason: "unsupervised" });
   // Enforced here and not only in the UI. Under --no-persist a restart destroys
   // the whole canvas — replayLog has no file to read — and a destructive act
   // must not be prevented by a hidden button alone.
   if (!_canRestart) return send(res, 409, { ok: false, reason: "no_persist" });
+
+  let wantUpgrade = false;
+  if (req.method === "POST") {
+    const body = await readBody(req).catch(() => null);
+    try { wantUpgrade = JSON.parse(body ?? "")?.upgrade === true; } catch { /* a plain restart */ }
+  }
+  let mode = null;
+  if (wantUpgrade) {
+    const { upgradeBlock, upgradeMode, npxRestartSpec } = await import(
+      pathToFileURL(join(PKG_ROOT, "src/server/self-update.mjs")).href
+    );
+    if (upgradeMode(upgradeBlock(PKG_ROOT)) !== "npx" || !npxRestartSpec(PKG_ROOT)) {
+      return send(res, 409, { ok: false, reason: "not_npx" });
+    }
+    mode = "npx";
+  }
+
   if (_restarting) return send(res, 202, { ok: true, already: true });
   _restarting = true;
-  send(res, 200, { ok: true });
+  send(res, 200, { ok: true, mode });
   // Let the response flush before the listener goes away.
-  setTimeout(() => { try { _onRestart(); } catch { _restarting = false; } }, 120).unref();
+  setTimeout(() => { try { _onRestart(mode); } catch { _restarting = false; } }, 120).unref();
 }
 
 async function handleQuota(req, res) {
@@ -1311,7 +1337,7 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
     if (req.method === "GET"  && url.pathname === "/events")     return handleSse(req, res);
     if (req.method === "GET"  && url.pathname === "/api/version")     return guard(handleVersion(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/upgrade")     return guard(handleUpgrade(req, res), res);
-    if (req.method === "POST" && url.pathname === "/api/restart")     return handleRestart(req, res);
+    if (req.method === "POST" && url.pathname === "/api/restart")     return guard(handleRestart(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/quota")       return guard(handleQuota(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/codex-usage")  return guard(handleCodexUsage(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/codex-quota") return guard(handleCodexQuota(req, res), res);

package/src/server/self-update.mjs

@@ -83,12 +83,65 @@ export function isGitCheckout(pkgRoot) {
   try { return existsSync(join(pkgRoot, ".git")); } catch { return false; }
 }
 
+// ── npx ──────────────────────────────────────────────────────────────────────
+//
+// An npx run lives in ~/.npm/_npx/<hash>/node_modules/<pkg>. The hash is over
+// the SPEC the user typed, so upgrading means fetching a different directory —
+// there is nothing to install over. What there IS, is the spec itself: npm
+// writes it into <hash>/package.json as `_npx.packages`, which is the only
+// record of whether the user typed `ccdeck`, `agent-dag` or `agents-deck`.
+// Re-running the wrong one would work but would leave them on a package they
+// never asked for, so it is worth reading rather than guessing.
+
+/** The `_npx/<hash>` directory this package was unpacked into, or null. Pure —
+ *  path arithmetic only, so both platforms' separators can be tested. */
+export function npxRoot(pkgRoot) {
+  if (typeof pkgRoot !== "string") return null;
+  const parts = pkgRoot.split(/[\\/]/);
+  const i = parts.lastIndexOf("_npx");
+  if (i === -1 || i + 1 >= parts.length) return null;
+  // Keep the separator the input used: a Windows path must come back as one.
+  const sep = pkgRoot.includes("\\") && !pkgRoot.includes("/") ? "\\" : "/";
+  return parts.slice(0, i + 2).join(sep);
+}
+
+/** Package name out of an npm spec, scope intact: `ccdeck@1.2.3` → `ccdeck`,
+ *  `@scope/pkg` → `@scope/pkg`. Null for anything that is not a plain name —
+ *  a tarball URL or a git spec is not something to re-run with `@latest`. */
+export function bareSpecName(spec) {
+  if (typeof spec !== "string") return null;
+  const s = spec.trim();
+  if (!s) return null;
+  const at = s.lastIndexOf("@");
+  const name = at > 0 ? s.slice(0, at) : s;
+  return /^@?[a-z0-9][a-z0-9._-]*(\/[a-z0-9][a-z0-9._-]*)?$/i.test(name) ? name : null;
+}
+
+/** What to hand `npx -y`, read from the cache directory's own metadata. */
+export function npxSpecFromMeta(meta, fallback = "agents-deck") {
+  const list = meta && meta._npx && Array.isArray(meta._npx.packages) ? meta._npx.packages : [];
+  for (const entry of list) {
+    const name = bareSpecName(entry);
+    if (name) return `${name}@latest`;
+  }
+  return `${fallback}@latest`;
+}
+
+/** The same, answered against the filesystem. Null when this is not an npx run. */
+export function npxRestartSpec(pkgRoot, name = "agents-deck") {
+  const root = npxRoot(pkgRoot);
+  if (!root) return null;
+  let meta = null;
+  try { meta = JSON.parse(readFileSync(join(root, "package.json"), "utf8")); } catch { /* fall back to the name */ }
+  return npxSpecFromMeta(meta, name);
+}
+
 /** The exact line the user can paste, for the way THIS copy was installed. */
 export function upgradeCommand(pkgRoot, name = "agents-deck") {
   // A checkout is updated by pulling, and the bundle is built, not shipped —
   // so `npm run build` is part of the answer rather than an afterthought.
   if (isGitCheckout(pkgRoot)) return "git pull && npm run build";
-  if (isNpxInstall(pkgRoot)) return `npx -y ${name}@latest`;
+  if (isNpxInstall(pkgRoot)) return `npx -y ${npxRestartSpec(pkgRoot, name) ?? `${name}@latest`}`;
   return `npm i -g ${name}@latest`;
 }
 
@@ -192,6 +245,23 @@ export function upgradeBlockedReason({ git, npx, writable, optedOut }) {
   return null;
 }
 
+/**
+ * How this copy can update itself, if it can at all.
+ *
+ *   "install" — `npm i -g` here and restart into the new files.
+ *   "npx"     — nothing to install: the supervisor re-runs `npx -y <spec>`,
+ *               which fetches a NEW cache directory and hands the port to it.
+ *   null      — a checkout, an unwritable prefix, or an explicit opt-out; the
+ *               user gets the command and does it themselves.
+ *
+ * Pure, so the policy is one readable expression rather than three conditions
+ * spread across the server and the UI.
+ */
+export function upgradeMode(blockedReason) {
+  if (blockedReason === null || blockedReason === undefined) return "install";
+  return blockedReason === "npx" ? "npx" : null;
+}
+
 function dirWritable(p) {
   try { accessSync(p, FS.W_OK); return true; } catch { return false; }
 }
@@ -296,6 +366,7 @@ export async function versionReport({ running, pkgRoot, name = "agents-deck", no
     process.env.AGENTS_DECK_NO_UPDATE_CHECK === "1" ||
     process.env.AGENTS_DECK_NO_INSTALL === "1";
   const latest = skipRegistry ? null : await latestOnNpm(name, now);
+  const blocked = upgradeBlock(pkgRoot);
   return {
     name,
     running: running ?? null,
@@ -303,9 +374,11 @@ export async function versionReport({ running, pkgRoot, name = "agents-deck", no
     latest,
     notice: pickNotice({ running, installed, latest }),
     command: upgradeCommand(pkgRoot, name),
-    // Why the Update button is absent, when it is — so the UI can say so
-    // instead of leaving a gap the user has to guess about.
-    upgradeBlocked: upgradeBlock(pkgRoot),
+    // Why an in-app `npm i -g` is refused, when it is — so the UI can say so
+    // instead of leaving a gap the user has to guess about. "npx" is a refusal
+    // of the install, not of the update: upgradeMode says so.
+    upgradeBlocked: blocked,
+    upgradeMode: upgradeMode(blocked),
     upgrade: upgradeStatus(),
   };
 }