agent-dag 1.33.20 → 1.33.22

package/dist/web/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>agents-deck</title>
     <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'%3E%3Ctext y='84' font-size='84'%3E%E2%97%89%3C/text%3E%3C/svg%3E" />
-    <script type="module" crossorigin src="/assets/index-DLJMh8ec.js"></script>
+    <script type="module" crossorigin src="/assets/index-BC3e-3-4.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-Cpi89XJ8.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "1.33.20",
+  "version": "1.33.22",
   "description": "Live deck of Claude Code and Codex agents — watch parallel subagents fork, call tools, and return on one calm canvas. Also available as npx ccdeck and npx agent-dag.",
   "type": "module",
   "bin": {

package/src/server/ccusage.mjs

@@ -37,6 +37,16 @@ const NPM_SHELL = process.platform === "win32";
 let _installing = null;   // Promise guard so concurrent calls share one install
 let _checkedThisRun = false; // only kick the daily check once per process boot
 
+// AGENTS_DECK_NO_INSTALL=1 is documented as "never install or update
+// claude-swap / ccusage, and never ask npm about releases", so it has to hold
+// on the lazy path too — opening the usage-history modal must not be a way to
+// pull ccusage off the registry behind the user's back. Read per call rather
+// than once at import, because the module is imported lazily and a test (or an
+// embedder) may set it after load.
+function installsDisabled() {
+  return process.env.AGENTS_DECK_NO_INSTALL === "1";
+}
+
 // ── managed install ─────────────────────────────────────────────────────────
 
 // Absolute path to ccusage's CLI entry inside our managed install, or null if
@@ -103,6 +113,7 @@ function touchMarker() {
 
 // Non-blocking: compare installed version to npm `latest`; install if newer.
 function maybeBackgroundUpdate(installedVersion) {
+  if (installsDisabled()) return; // no `npm view`, no upgrade install
   if (_checkedThisRun || !updateCheckDue()) return;
   _checkedThisRun = true;
   touchMarker();
@@ -127,6 +138,13 @@ async function getRunner() {
     maybeBackgroundUpdate(resolved.version);
     return { kind: "node", entry: resolved.entry };
   }
+  // Nothing installed and installs are forbidden. The npx fallback is not an
+  // escape hatch — `npx -y ccusage@latest` downloads and runs the same package
+  // — so there is no runner to hand back. Fail with the reason, which the
+  // usage-history modal shows, instead of quietly installing.
+  if (installsDisabled()) {
+    throw new Error("ccusage is not installed, and installs are off (AGENTS_DECK_NO_INSTALL=1)");
+  }
   // Cold: install once (deduped across concurrent callers).
   if (!_installing) {
     _installing = (async () => { installSync("latest"); })()
@@ -232,6 +250,13 @@ export async function fetchCcusageDaily({ since, until, force = false } = {}) {
  * not hold up the server.
  */
 export function primeCcusage() {
+  // The CLI already skips this call under AGENTS_DECK_NO_INSTALL=1; repeating
+  // the check here keeps the promise a property of the module rather than of
+  // one caller.
+  if (installsDisabled()) {
+    const have = resolveEntry();
+    return have ? { state: "present", version: have.version } : { state: "unavailable" };
+  }
   const resolved = resolveEntry();
   if (resolved) {
     // Already installed: the daily check may still queue a background upgrade.

package/src/server/installer.mjs

@@ -4,10 +4,11 @@
 // Both providers share the discovery dir at ~/.claude/agent-dag/ so a single
 // running server can receive events from either CLI. Re-runs are safe; entries
 // are tagged with __agent-dag and de-duped.
-import { readFile, writeFile, mkdir, copyFile, unlink } from "node:fs/promises";
+import { readFile, writeFile, mkdir, copyFile, unlink, rename, open, stat, chmod } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve, dirname } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 import { fileURLToPath } from "node:url";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -128,7 +129,7 @@ async function readSettingsForWrite(p) {
   try {
     raw = await readFile(p, "utf8");
   } catch (err) {
-    if (err?.code === "ENOENT") return {};
+    if (err?.code === "ENOENT") return { settings: {}, raw: null };
     throw unreadableSettings(p, err?.message ?? String(err));
   }
   let parsed;
@@ -140,7 +141,61 @@ async function readSettingsForWrite(p) {
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw unreadableSettings(p, "top level is not a JSON object");
   }
-  return parsed;
+  return { settings: parsed, raw };
+}
+
+// Rename over an open file is the one thing Windows does differently here. The
+// call itself is atomic (MoveFileEx with MOVEFILE_REPLACE_EXISTING), but it
+// fails outright while another process holds the target open — and a virus
+// scanner or the search indexer opens files the instant they are written, for a
+// few milliseconds at a time. Retrying a sharing violation a handful of times
+// turns that into a successful install. POSIX never hits this path, and a real
+// permission error just costs an extra fraction of a second before it surfaces.
+const RENAME_RETRY_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
+
+async function renameWithRetry(from, to, attempts = 5) {
+  for (let attempt = 1; ; attempt++) {
+    try {
+      await rename(from, to);
+      return;
+    } catch (err) {
+      if (attempt >= attempts || !RENAME_RETRY_CODES.has(err?.code)) throw err;
+      await delay(20 * attempt);
+    }
+  }
+}
+
+/**
+ * Replace a file in a single step readers cannot land inside.
+ *
+ * The temp file is created beside the target rather than in $TMPDIR, because
+ * rename is only atomic within one filesystem and the two are routinely on
+ * different ones. It is fsync'd before the rename so that a crash or power loss
+ * just after a successful install cannot leave the new directory entry pointing
+ * at blocks that were never flushed — the classic file-of-zero-bytes. The pid in
+ * the name keeps two decks starting at once off each other's temp file.
+ */
+async function writeFileAtomic(target, text) {
+  const tmp = `${target}.agent-dag-${process.pid}.tmp`;
+  let handle;
+  try {
+    handle = await open(tmp, "w");
+    await handle.writeFile(text, "utf8");
+    await handle.sync();
+  } finally {
+    await handle?.close();
+  }
+  try {
+    // A rename creates a fresh directory entry, so the old file's mode does not
+    // come with it. Carry it over — a settings.json the user chmod'ed to 600 has
+    // to stay 600. No-op on Windows, where chmod only toggles the read-only bit.
+    const mode = await stat(target).then(s => s.mode, () => null);
+    if (mode !== null) await chmod(tmp, mode).catch(() => {});
+    await renameWithRetry(tmp, target);
+  } catch (err) {
+    await unlink(tmp).catch(() => {});
+    throw err;
+  }
 }
 
 async function installHookScript(installDir) {
@@ -163,14 +218,14 @@ function dedupeOurEntries(group) {
   return group.filter(g => !isOurEntry(g));
 }
 
-/** Install hooks for a single provider. Returns {settingsPath, hookPath, events}. */
+/** Install hooks for a single provider. Returns {settingsPath, hookPath, events, changed}. */
 export async function installHooks({ provider = "claude" } = {}) {
   const cfg = PROVIDERS[provider];
   if (!cfg) throw new Error(`unknown provider: ${provider}`);
 
   // Read before writing anything, so a settings file we cannot parse aborts
   // the install without leaving half of it behind.
-  const current = await readSettingsForWrite(cfg.settingsPath);
+  const { settings: current, raw: before } = await readSettingsForWrite(cfg.settingsPath);
 
   const hookPath = await installHookScript(cfg.hookInstallDir);
   const command = hookCommand(hookPath, provider);
@@ -186,8 +241,15 @@ export async function installHooks({ provider = "claude" } = {}) {
     current.hooks[evt] = cleaned;
   }
 
-  await writeFile(cfg.settingsPath, JSON.stringify(current, null, 2) + "\n", "utf8");
-  return { settingsPath: cfg.settingsPath, hookPath, events: cfg.events, provider };
+  // Every launch reinstalls, and on all but the first the entries are already
+  // there and identical. Writing anyway is pure downside: it is one more chance
+  // to be interrupted mid-write, and one more window in which a change Claude
+  // Code made to the file between our read and our write gets discarded. So
+  // compare against the exact bytes we read and, when they match, do nothing.
+  const next = JSON.stringify(current, null, 2) + "\n";
+  const changed = next !== before;
+  if (changed) await writeFileAtomic(cfg.settingsPath, next);
+  return { settingsPath: cfg.settingsPath, hookPath, events: cfg.events, provider, changed };
 }
 
 export async function uninstallHooks({ provider = "claude" } = {}) {
@@ -202,7 +264,7 @@ export async function uninstallHooks({ provider = "claude" } = {}) {
     if (cleaned.length === 0) delete current.hooks[evt];
     else current.hooks[evt] = cleaned;
   }
-  if (changed) await writeFile(cfg.settingsPath, JSON.stringify(current, null, 2) + "\n", "utf8");
+  if (changed) await writeFileAtomic(cfg.settingsPath, JSON.stringify(current, null, 2) + "\n");
   return { changed, provider, settingsPath: cfg.settingsPath };
 }