npm - agent-dag - Versions diffs - 1.33.11 → 1.33.13 - Mend

agent-dag 1.33.11 → 1.33.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/web/assets/{index-Cjhxhzjo.js → index-Cif0aUlE.js} +1 -1
package/dist/web/index.html +1 -1
package/package.json +1 -1
package/src/server/exec.mjs +21 -6
package/src/server/index.mjs +20 -1

package/dist/web/index.html CHANGED Viewed

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>agents-deck</title>
     <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'%3E%3Ctext y='84' font-size='84'%3E%E2%97%89%3C/text%3E%3C/svg%3E" />
-    <script type="module" crossorigin src="/assets/index-Cjhxhzjo.js"></script>
+    <script type="module" crossorigin src="/assets/index-Cif0aUlE.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-Cpi89XJ8.css">
   </head>
   <body>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "1.33.11",
+  "version": "1.33.13",
   "description": "Live deck of Claude Code and Codex agents — watch parallel subagents fork, call tools, and return on one calm canvas. Also available as npx ccdeck and npx agent-dag.",
   "type": "module",
   "bin": {

package/src/server/exec.mjs CHANGED Viewed

@@ -199,24 +199,39 @@ export function runInteractive(cmd, args, { timeout = 300_000, maxOutput = 256 <
     if (i >= tries.length) return finish(-1, { code: "ENOENT" });
     const raw = tries[i];
     const { file, args: argv, opts } = isBatch(raw) ? viaCmd(raw, args) : { file: raw, args, opts: {} };
+    let proc;
     try {
-      child = spawn(file, argv, { stdio: ["pipe", "pipe", "pipe"], shell: false, windowsHide: true, ...opts });
+      proc = spawn(file, argv, { stdio: ["pipe", "pipe", "pipe"], shell: false, windowsHide: true, ...opts });
     } catch (err) {
       return tryNext(err) ? attempt(i + 1) : finish(-1, err);
     }
-    child.on("error", (err) => {
+    child = proc;
+    // A spelling that fails to spawn emits 'error' AND THEN 'close' — with code
+    // -2 after an ENOENT. Once the error handler has moved on to the next
+    // candidate, that trailing 'close' is news about a child nobody is waiting
+    // for any more, and answering it settled `done` with ok:false while the
+    // real child was still running. On Windows that is the normal path, not a
+    // corner case: `claude.exe` does not exist, `claude.cmd` does, so the very
+    // first login reported "the code was not accepted" while the child it had
+    // abandoned went on to complete the OAuth and switch the live account.
+    // Every listener below therefore speaks only while its own child is the
+    // current one.
+    const stale = () => proc !== child;
+    proc.on("error", (err) => {
+      if (stale()) return;
       // Only retry another spelling while nothing has run yet; a mid-run error
       // is this child's failure, not evidence the name was wrong.
       if (tryNext(err) && !stdout && !stderr) { child = null; return attempt(i + 1); }
       finish(-1, err);
     });
-    child.on("spawn", () => resolved.set(cmd, raw));
+    proc.on("spawn", () => resolved.set(cmd, raw));
     // Capped so a runaway child cannot grow the heap without bound; the tail is
     // what carries the error, so the head is what gets dropped.
     const keep = (buf, text) => (buf + text).slice(-maxOutput);
-    child.stdout?.on("data", (d) => { const t = String(d); stdout = keep(stdout, t); emitLines(t); });
-    child.stderr?.on("data", (d) => { const t = String(d); stderr = keep(stderr, t); emitLines(t); });
-    child.on("close", (code) => {
+    proc.stdout?.on("data", (d) => { if (stale()) return; const t = String(d); stdout = keep(stdout, t); emitLines(t); });
+    proc.stderr?.on("data", (d) => { if (stale()) return; const t = String(d); stderr = keep(stderr, t); emitLines(t); });
+    proc.on("close", (code) => {
+      if (stale()) return;
       // Same cmd.exe case as in `run`: exit 1 with "is not recognized" means
       // this spelling does not exist, not that the tool failed.
       if (code !== 0 && looksMissing(`${stderr}\n${stdout}`)) {

package/src/server/index.mjs CHANGED Viewed

@@ -1288,6 +1288,22 @@ function randomPort(min, max) {
   return Math.floor(Math.random() * (max - min + 1)) + min;
 }
+// Parse a request target into a URL, or null when it cannot be parsed.
+//
+// The base is the constant "http://localhost", never the Host header. Node's
+// HTTP parser hands the header through verbatim, so a client sending
+// `Host: bad host` used to produce `new URL("/", "http://bad host")`, which
+// throws ERR_INVALID_URL synchronously inside the request listener. Nothing
+// catches that — it becomes an uncaughtException, the worker exits 1 and the
+// supervisor tears the whole deck down for a single malformed request. Only
+// the path and the query are ever read from this URL, so the authority half
+// is free to be a constant — which is what every other new URL call site in
+// this file already does. Anything else unparseable answers 400 instead.
+export function requestUrl(rawUrl) {
+  try { return new URL(rawUrl ?? "/", "http://localhost"); }
+  catch { return null; }
+}
 async function tryListen(server, port, host) {
   return new Promise((res, rej) => {
     server.once("error", rej);
@@ -1340,7 +1356,10 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
   });
   const server = createServer((req, res) => {
-    const url = new URL(req.url ?? "/", `http://${req.headers.host ?? host}`);
+    const url = requestUrl(req.url);
+    // Unparseable request target. Nothing below can route it, and throwing here
+    // would be an uncaughtException inside the listener — i.e. the whole deck.
+    if (!url) return send(res, 400, { error: "bad request target" });
     if (req.method === "POST" && url.pathname === "/api/event") return guard(handleEventIngest(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/health") return handleHealth(req, res);