agent-dag 1.33.28 → 1.33.30

package/dist/web/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>agents-deck</title>
     <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'%3E%3Ctext y='84' font-size='84'%3E%E2%97%89%3C/text%3E%3C/svg%3E" />
-    <script type="module" crossorigin src="/assets/index-Bl3jQiYb.js"></script>
+    <script type="module" crossorigin src="/assets/index-DmDKN8d2.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-Cpi89XJ8.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "1.33.28",
+  "version": "1.33.30",
   "description": "Live deck of Claude Code and Codex agents — watch parallel subagents fork, call tools, and return on one calm canvas. Also available as npx ccdeck and npx agent-dag.",
   "type": "module",
   "bin": {

package/src/server/cswap-admin.mjs

@@ -16,6 +16,7 @@
 // concurrent adds pick the same number and the second write silently drops the
 // first account's record. Nothing upstream prevents it, so every mutation here
 // goes through one mutex.
+import { AsyncLocalStorage } from "node:async_hooks";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -49,15 +50,28 @@ function backupRoot() {
 
 let _chain = Promise.resolve();
 
+// Whether the code running right now is itself the mutation holding the lock.
+// Async context rather than a plain boolean, which could not tell that apart
+// from another request that merely arrived while the lock was held — and would
+// wave that one through, which is the opposite of a mutex.
+const _holder = new AsyncLocalStorage();
+
 /**
  * One store mutation at a time.
  *
  * Not defence against another process — that would need claude-swap's own file
  * lock, which `add` does not take either. This is defence against ourselves:
  * two browser tabs, or a double-click, are enough to race a slot assignment.
+ *
+ * Re-entrant, because a mutation that reaches for the lock from inside one
+ * would otherwise wait for itself forever: the chain cannot advance past the
+ * outer link until it settles, and the outer link is blocked on this call. It
+ * already has exclusive access, so it simply runs.
  */
 export function withStoreLock(fn) {
-  const next = _chain.then(fn, fn);
+  if (_holder.getStore()) return Promise.resolve().then(fn);
+  const held = () => _holder.run(true, fn);
+  const next = _chain.then(held, held);
   // Keep the chain alive even when a link rejects, or every later mutation
   // inherits the failure.
   _chain = next.then(() => {}, () => {});
@@ -329,13 +343,26 @@ export async function submitLoginCode(code) {
 export async function cancelLogin() {
   const flow = _login;
   if (!flow) return { ok: true, ...loginState() };
+  // Stopping the child touches no file, so it happens straight away: a cancel
+  // that waited its turn first would leave `claude auth login` sitting on the
+  // user's next attempt for the rest of its five minutes.
   try { flow.child?.kill(); } catch { /* already gone */ }
-  // The login may have completed before the cancel arrived, in which case the
-  // live credentials already moved and putting them back is the point.
-  await restoreActive(flow.previousActive);
-  invalidateClaudeAccountsCache();
-  _login = null;
-  return { ok: true, ...loginState() };
+  // Switching back does touch the store, so it is queued like every other
+  // mutation. Cancel is reachable while submitLoginCode holds the lock — the
+  // dialog fires it on Escape, mid-registration — and running `cswap switch`
+  // beside an in-flight `cswap add` is precisely the unlocked read-modify-write
+  // of sequence.json the mutex exists to prevent: claude-swap takes no file lock
+  // around `add`, so whichever write lands second drops the other's record.
+  return withStoreLock(async () => {
+    // The login may have completed before the cancel arrived, in which case the
+    // live credentials already moved and putting them back is the point.
+    await restoreActive(flow.previousActive);
+    invalidateClaudeAccountsCache();
+    // A newer sign-in can have started while this waited its turn; clearing the
+    // slot then would drop a live flow's handle instead of this dead one's.
+    if (flow === _login) _login = null;
+    return { ok: true, ...loginState() };
+  });
 }
 
 /** Put the account that was active before the login back in front. */

package/src/server/quota.mjs

@@ -238,13 +238,15 @@ function stripAnsi(s) {
  */
 // Parse "Jun 18, 4:09pm" (local time, no tz) into unix seconds.
 // Claude shows times in the user's local timezone, so parsing as local is correct.
-function parseResetToSec(resetStr) {
+export function parseResetToSec(resetStr) {
   if (!resetStr) return null;
   try {
     const year = new Date().getFullYear();
-    // "4:09pm" → "4:09 PM" so Date.parse handles it
+    // "4:09pm" → "4:09 PM" so Date.parse handles it. Minutes are optional in
+    // the CLI's output ("9am"); Date.parse rejects "9 AM", so supply ":00".
     const norm = resetStr
-      .replace(/(\d{1,2}:\d{2})(am|pm)/i, "$1 $2")
+      .replace(/(\d{1,2})(?::(\d{2}))?\s*(am|pm)/i,
+               (_all, h, mm, ampm) => `${h}:${mm ?? "00"} ${ampm}`)
       .trim();
     const d = new Date(`${norm} ${year}`);
     return isNaN(d.getTime()) ? null : Math.floor(d.getTime() / 1000);