agent-dag 1.33.80 → 1.33.82

package/dist/web/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>agents-deck</title>
     <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'%3E%3Ctext y='84' font-size='84'%3E%E2%97%89%3C/text%3E%3C/svg%3E" />
-    <script type="module" crossorigin src="/assets/index-5_r9cSQl.js"></script>
+    <script type="module" crossorigin src="/assets/index-CK4AFqll.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-dwRx-2y0.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "1.33.80",
+  "version": "1.33.82",
   "description": "Live deck of Claude Code and Codex agents — watch parallel subagents fork, call tools, and return on one calm canvas. Also available as npx ccdeck and npx agent-dag.",
   "type": "module",
   "bin": {

package/src/server/index.mjs

@@ -757,8 +757,12 @@ function maybeResolveCodex(payload) {
 // transcript enrichment (which needs transcript_path / hook events) but still
 // persists + broadcasts them exactly like a hook event. This path is entirely
 // additive — the Claude hook flow is untouched.
-const codexFileState = new Map();      // path -> { offset, sid, cwd, skip }
+const codexFileState = new Map();      // path -> { offset, sid, cwd, skip, seenAt }
 const codexSessionModel = new Map();   // sid -> last model string
+// How long a rollout's tail cursor is kept after it stops showing up in the
+// listing. The listing covers two day-directories, so anything missing from it
+// is at least a day old and will never be appended to again.
+const CODEX_STATE_TTL_MS = 10 * 60 * 1000;
 let codexScanRunning = false;
 let codexWatchTimer = null;
 let codexWorkspace = "";
@@ -902,11 +906,13 @@ async function codexScanOnce(firstRun) {
   if (codexScanRunning) return;
   codexScanRunning = true;
   try {
+    const now = Date.now();
     const files = await listRecentCodexRollouts();
     for (const path of files) {
       let st;
       try { st = await stat(path); } catch { continue; }
       let state = codexFileState.get(path);
+      if (state) state.seenAt = now;
 
       if (!state) {
         // New file — read the header for sid + cwd, then decide whether to
@@ -914,10 +920,10 @@ async function codexScanOnce(firstRun) {
         const header = await readCodexHeader(path);
         if (!header || !header.sid) continue; // not ready yet — retry next tick
         if (!codexCwdInWorkspace(header.cwd)) {
-          codexFileState.set(path, { offset: st.size, sid: header.sid, cwd: header.cwd, skip: true, rootEmitted: false });
+          codexFileState.set(path, { offset: st.size, sid: header.sid, cwd: header.cwd, skip: true, rootEmitted: false, seenAt: now });
           continue;
         }
-        state = { offset: 0, sid: header.sid, cwd: header.cwd, skip: false, rootEmitted: false };
+        state = { offset: 0, sid: header.sid, cwd: header.cwd, skip: false, rootEmitted: false, seenAt: now };
         codexFileState.set(path, state);
         if (firstRun) {
           // On startup, skip a pre-existing session's history entirely — no
@@ -955,6 +961,15 @@ async function codexScanOnce(firstRun) {
         }
       }
     }
+
+    // Rollout files fall out of the newest-2-days listing and never come back,
+    // but their tail cursors used to live as long as the process did. Expire by
+    // "not seen for a while" rather than "absent from this listing": a single
+    // unreadable directory mid-scan would otherwise drop a live file's cursor,
+    // and re-adding it at offset 0 replays that entire rollout as fresh events.
+    for (const [p, s] of codexFileState) {
+      if (now - (s.seenAt ?? 0) > CODEX_STATE_TTL_MS) codexFileState.delete(p);
+    }
   } catch {
     /* swallow — watcher must never crash the server */
   } finally {
@@ -988,6 +1003,79 @@ export function eventsSince(seq) {
   return events.filter(e => e.seq > after);
 }
 
+// ─── Per-session cache expiry ────────────────────────────────────────────
+// Every enrichment cache above is keyed by session id and nothing ever
+// removed an entry: a deck left up for weeks — the 24/7 use this thing is
+// built for — kept a model string, a subagent signature and four read-throttle
+// stamps for every session it had ever seen, plus the Codex rollout path and
+// model of each. SessionEnd is not a usable eviction signal (a killed CLI
+// never sends one, and Codex has no such hook at all), so entries expire by
+// least-recent use against a cap instead — the same shape pruneTranscriptScans
+// already uses for its per-path state. The cap sits far above any plausible
+// number of concurrent sessions, so a live session is never evicted; and an
+// evicted one that speaks again simply re-reads its transcript.
+const sessionTouchedAt = new Map();   // sid -> ms of the last event seen
+const MAX_TRACKED_SESSIONS = 256;
+
+function forgetSession(sid) {
+  modelBySession.delete(sid);
+  modelLastReadAt.delete(sid);
+  lastUsageReadAt.delete(sid);
+  lastContextReadAt.delete(sid);
+  codexRolloutPathBySid.delete(sid);
+  lastCodexUsageReadAt.delete(sid);
+  codexSessionModel.delete(sid);
+}
+
+function touchSession(sid) {
+  if (!sid || typeof sid !== "string") return;
+  // Re-insert so the Map's own insertion order *is* the LRU order and eviction
+  // below is one key read rather than a scan of every session ever seen.
+  sessionTouchedAt.delete(sid);
+  sessionTouchedAt.set(sid, Date.now());
+  while (sessionTouchedAt.size > MAX_TRACKED_SESSIONS) {
+    const oldest = sessionTouchedAt.keys().next().value;
+    sessionTouchedAt.delete(oldest);
+    forgetSession(oldest);
+  }
+}
+
+// ─── SSE backpressure ────────────────────────────────────────────────────
+// A client that stops reading without closing its socket — a frozen tab, a
+// suspended machine, a stalled `ssh -L` tunnel — never fires 'close' and never
+// makes write() throw, so the old `try { res.write(line) } catch {}` had no
+// way to notice it. On loopback nothing times the connection out either, so
+// every event (tool responses run to megabytes) queued in that socket's write
+// buffer for as long as the process lived.
+//
+// We drop the client rather than the events. EventSource reconnects after the
+// `retry: 1500` we send on connect and resumes from Last-Event-ID, so the ring
+// buffer replays whatever it missed. Dropping individual events instead would
+// leave a hole the resume path cannot even see, the client's last id having
+// moved past it.
+const MAX_CLIENT_BUFFER_BYTES = 8 * 1024 * 1024;
+
+/** Bytes queued for a client: what the response has not handed to the socket
+ *  yet, plus what the socket has not handed to the kernel. */
+function queuedBytes(res) {
+  const own = typeof res.writableLength === "number" ? res.writableLength : 0;
+  const sock = res.socket && typeof res.socket.writableLength === "number" ? res.socket.writableLength : 0;
+  return own + sock;
+}
+
+/** Write one SSE frame, hanging up on a client too far behind to keep. */
+function writeSse(res, frame) {
+  try {
+    res.write(frame);
+    if (queuedBytes(res) <= MAX_CLIENT_BUFFER_BYTES) return;
+  } catch { /* already dead — drop it below */ }
+  sseClients.delete(res);
+  // Destroying the socket is what makes the request emit 'close', which is
+  // where the ping interval is cleared.
+  try { res.destroy(); } catch {}
+  try { res.socket?.destroy(); } catch {}
+}
+
 function pushEvent(raw, source, opts = {}) {
   // Synchronous enrichment: if we already know this session's model, stamp
   // it on the payload so the client's recursive scanner picks it up.
@@ -1007,18 +1095,42 @@ function pushEvent(raw, source, opts = {}) {
   events.push(evt);
   if (events.length > MAX_BUFFER) events.splice(0, events.length - MAX_BUFFER);
 
-  const line = `id: ${seq}\nevent: hook\ndata: ${JSON.stringify(evt)}\n\n`;
-  for (const res of sseClients) {
-    try { res.write(line); } catch {}
+  // Does this event reach the log at all? Not on a replay (it came from
+  // there), not when the hook told us another deck owns this session's log,
+  // and not when we have no log. Decided before serializing because it is half
+  // of the answer to whether serializing is worth doing.
+  const persisting = persistPath && !opts.replay && opts.persist !== false && writesLogFor(raw);
+
+  // One serialization, shared by both consumers — and skipped entirely when
+  // neither wants it. This used to stringify the whole envelope twice on the
+  // hottest path in the process (once for the SSE frame, once for the persist
+  // line), and built the frame even with nobody subscribed: a headless deck
+  // paid a full stringify per event for a string no one read, and boot replay
+  // — which runs before the listener exists and never broadcasts — paid one
+  // for every line of a log that rotates at 50MB. An event this deck is not
+  // logging is still broadcast, so a subscriber alone is reason enough.
+  const json = (sseClients.size > 0 || persisting) ? JSON.stringify(evt) : null;
+
+  if (sseClients.size > 0) {
+    const line = `id: ${seq}\nevent: hook\ndata: ${json}\n\n`;
+    // writeSse may drop a client mid-loop; deleting from a Set while iterating
+    // it is well defined and skips only the entry removed.
+    for (const res of sseClients) writeSse(res, line);
   }
 
-  if (persistPath && !opts.replay && opts.persist !== false && writesLogFor(raw)) {
+  if (persisting) {
     // Fire-and-forget append. JSONL = newline-delimited JSON.
-    appendFile(persistPath, JSON.stringify(evt) + "\n", "utf8").catch(() => {});
+    appendFile(persistPath, json + "\n", "utf8").catch(() => {});
     // Cheap throttled check (every 30s) — only rotates if file > 50MB.
     maybeRotatePersistFile();
   }
 
+  // Note the session so the caches the scanners below fill can expire by
+  // least-recent use. Replays are excluded: they fill nothing, and a boot
+  // replay of a log spanning weeks would otherwise churn the whole LRU through
+  // dead session ids before the first live event even arrives.
+  if (!opts.replay && raw && typeof raw === "object") touchSession(raw.session_id);
+
   // Kick off async transcript scans. Model arrives as a one-shot
   // ModelObserved; usage is re-read periodically (throttled to 2.5s per
   // session) so the cost columns track running totals as the session
@@ -1161,9 +1273,10 @@ function handleSse(req, res) {
   res.write(`event: replay-end\ndata: {}\n\n`);
 
   sseClients.add(res);
-  const ping = setInterval(() => {
-    try { res.write(`: ping\n\n`); } catch {}
-  }, 15000);
+  // Through writeSse like every other frame: on a client that has stopped
+  // reading, the ping is the one thing still being written between events, and
+  // it is what eventually reveals the socket as unrecoverable.
+  const ping = setInterval(() => writeSse(res, `: ping\n\n`), 15000);
 
   req.on("close", () => {
     clearInterval(ping);

package/src/server/npx.mjs

@@ -0,0 +1,133 @@
+// How to run npx from a supervisor that cannot afford npx to be broken.
+//
+// The supervisor's upgrade path is `npx -y <spec>@latest`, and it used to
+// resolve npx by bare name — `npx.cmd` on Windows — letting the OS find it on
+// PATH. That trusts a batch shim to be sitting in a real npm install root,
+// because the shim computes everything else from its own directory:
+//
+//   SET "NPX_CLI_JS=%~dp0\node_modules\npm\bin\npx-cli.js"
+//   SET "NPM_PREFIX_JS=%~dp0\node_modules\npm\bin\npm-prefix.js"
+//
+// Reported from a Windows machine on Node 24 where `%~dp0` was the user's home
+// directory and no `node_modules\npm` existed under it — the usual cause is an
+// npm global prefix pointed somewhere the shim did not follow. Clicking
+// "Update & restart" printed a raw MODULE_NOT_FOUND stack trace and came back
+// on the same version.
+//
+// Node ships npm, so npx's real entry point can be reached from
+// `process.execPath` with no PATH lookup, no batch file, and no shim-relative
+// arithmetic. That is what this prefers. The shim stays as the fallback for
+// installs whose npm lives somewhere else entirely, and it still goes through
+// spawnSpec — the cmd.exe quoting there is load-bearing and unchanged.
+import { existsSync } from "node:fs";
+import { spawnSpec } from "./exec.mjs";
+
+/**
+ * Where npm's own `npx-cli.js` sits relative to the running Node binary, most
+ * likely first. Pure: the platform and the executable path are parameters, so
+ * the Windows layout can be checked from any OS.
+ *
+ * Windows keeps npm beside node.exe (`C:\Program Files\nodejs\node_modules\npm`,
+ * and the same shape under nvm-windows). POSIX puts it in a `lib` next to the
+ * `bin` — usually the parent (`/usr/local/bin/node` →
+ * `/usr/local/lib/node_modules/npm`, as for nvm, fnm and Volta), but not
+ * always: Homebrew's node lives in `/usr/local/Cellar/node/<v>/bin` while its
+ * npm stays at the prefix, four levels up. So the `lib` spelling is tried at
+ * each of the first four ancestors rather than only at the parent. Every
+ * candidate is confirmed by the exact file existing, so a wider search cannot
+ * pick something that is not npm.
+ *
+ * The path arithmetic is done on the string rather than through `node:path`,
+ * for the same reason npxRoot in self-update.mjs does: `path` here is the
+ * platform running the SUITE, so a Windows layout checked from macOS would come
+ * back with forward slashes and a `..` nothing resolves.
+ */
+export function npxCliCandidates(execPath = process.execPath, platform = process.platform) {
+  if (typeof execPath !== "string" || !execPath) return [];
+  const sep = platform === "win32" ? "\\" : "/";
+  const dir = execPath.split(/[\\/]/);
+  dir.pop(); // the binary itself
+  if (!dir.length) return [];
+  const beside = [...dir, "node_modules", "npm", "bin", "npx-cli.js"].join(sep);
+  const above = [];
+  for (let up = 1; up <= 4 && dir.length - up > 0; up++) {
+    above.push([...dir.slice(0, -up), "lib", "node_modules", "npm", "bin", "npx-cli.js"].join(sep));
+  }
+  return platform === "win32" ? [beside, ...above] : [...above, beside];
+}
+
+/**
+ * What to hand `spawn` to run `npx <args>`.
+ *
+ * Returns `{ file, args, opts, via }`, where `via` is "node" for the bundled
+ * CLI and "shim" for the PATH lookup. `exists` is injected so the choice can be
+ * tested without a matching Node install on the machine running the suite.
+ */
+export function npxLaunch(args, {
+  platform = process.platform,
+  execPath = process.execPath,
+  exists = existsSync,
+} = {}) {
+  for (const cli of npxCliCandidates(execPath, platform)) {
+    let found = false;
+    try { found = exists(cli); } catch { found = false; }
+    // Same node, same npm, spawned directly: nothing here reads PATH and
+    // nothing resolves a path relative to a shim's own directory.
+    if (found) return { file: execPath, args: [cli, ...args], opts: {}, via: "node", cli };
+  }
+  const shim = platform === "win32" ? "npx.cmd" : "npx";
+  return { ...spawnSpec(shim, args, platform), via: "shim", cli: null };
+}
+
+// Lines that are structure rather than content: a Node crash prints a stack,
+// the source line it threw on, a caret under it, then the error object's own
+// fields and the runtime version. None of that tells a user of a DAG dashboard
+// what went wrong.
+const NOISE = [
+  /^\s*at\s/,
+  /^\s*\^+\s*$/,
+  /^node:internal\//,
+  /^\s*throw\s/,
+  /^Node\.js v/,
+  /^\s*[{}]\s*$/,
+  /^\s*(code|errno|syscall|path|requireStack|stack):/,
+  /^A complete log/,
+];
+
+// The line worth quoting, when there is one. npm's failures and Node's both
+// lead with the sentence a person can act on; everything after it is detail.
+const SIGNAL = /(Error:|error code|ERR_|No matching version|ENOENT|EACCES|EPERM|not found|permission denied)/i;
+
+/**
+ * One line summarising why an npx run failed, or null when its output said
+ * nothing. Pure, and separate from the printing, because "do not dump a stack
+ * trace at the user" is the rule and a rule worth a bug is worth a test.
+ */
+export function npxFailureSummary(output) {
+  const lines = String(output ?? "")
+    .split(/\r?\n/)
+    // A warning is by definition not the reason this failed, and npm emits one
+    // for every ordinary exec ("the following package will be installed") whose
+    // wording would otherwise outrank the real error below it.
+    .filter(l => !/^npm (WARN|warn)\b/.test(l))
+    .map(l => l.replace(/^npm (ERR!|error)\s*/i, "").trimEnd())
+    .filter(l => l.trim() && !NOISE.some(re => re.test(l)));
+  if (!lines.length) return null;
+  const pick = lines.find(l => SIGNAL.test(l)) ?? lines[lines.length - 1];
+  return pick.trim().slice(0, 300);
+}
+
+/**
+ * The actionable half, for the one failure shape that is a broken environment
+ * rather than a broken network: npx exists, runs, and cannot find the npm it is
+ * supposed to load. `npm config get prefix` is the thing to check — a prefix
+ * pointing at a directory with no `node_modules/npm` under it leaves exactly
+ * this trace.
+ */
+export function npxFailureHint(output) {
+  const s = String(output ?? "");
+  if (/MODULE_NOT_FOUND/.test(s) && /(npx-cli\.js|npm-cli\.js|npm-prefix\.js)/.test(s)) {
+    return "the npx on PATH is a shim whose npm install is missing — check `npm config get prefix`";
+  }
+  return null;
+}

package/src/server/self-update.mjs

@@ -21,7 +21,7 @@
 // it by name and only where it can actually work: a global install, on a
 // directory we can write, outside a git checkout and outside an npx cache.
 // Everywhere else this stays what it has always been — a printed command.
-import { accessSync, constants as FS, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { accessSync, constants as FS, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
@@ -267,6 +267,12 @@ async function isPublished(name, version) {
  *  cannot produce a path the OS refuses. An unusable name falls back to the
  *  default rather than to the shared file this fix exists to get rid of. */
 export function markerFileName(name = "agents-deck") {
+  return `.self-update-check-${safeNamePart(name)}`;
+}
+
+/** The sanitised half, shared with the restart-failure note below so the two
+ *  files agree on what a package name becomes on disk. */
+function safeNamePart(name) {
   const raw = typeof name === "string" ? name.trim().toLowerCase() : "";
   const safe = raw
     .replace(/^@/, "")
@@ -276,7 +282,7 @@ export function markerFileName(name = "agents-deck") {
     // trailing dot from a file name, so a name that ends in one would write to
     // a path that is not the path we would later read.
     .replace(/^[-.]+|[-.]+$/g, "");
-  return `.self-update-check-${safe || "agents-deck"}`;
+  return safe || "agents-deck";
 }
 
 function markerPath(name) {
@@ -514,6 +520,84 @@ export function upgradeBlock(pkgRoot) {
   });
 }
 
+// ── the note a failed npx relaunch leaves behind ─────────────────────────────
+//
+// The npx upgrade is the one path whose failure the server cannot see. It runs
+// in the SUPERVISOR, after this process has already exited: the worker asks to
+// come back through `npx -y <spec>@latest`, npx fails, and the supervisor
+// relaunches the copy on disk. The new worker boots knowing nothing, so
+// /api/version kept answering `upgrade: {state:"idle"}` — the banner still
+// offered "Update & restart", the tab said nothing at all, and a user who
+// clicked the button without watching the terminal saw the deck blink and come
+// back unchanged. Every click then repeated the whole cycle identically.
+//
+// A file is the only channel between the two processes: the supervisor writes
+// one when the relaunch fails, and the worker it starts instead reads it here.
+// Same directory and same per-package naming as the update markers, for the
+// same reason — several decks share a home directory and must not answer for
+// each other.
+
+export function restartFailureFileName(name = "agents-deck") {
+  return `.restart-failed-${safeNamePart(name)}`;
+}
+
+function restartFailurePath(name) {
+  return join(MARKER_DIR, restartFailureFileName(name));
+}
+
+/** Called by the supervisor, in the moment between "npx failed" and "relaunch
+ *  the old copy". Best-effort: a read-only home costs the report, not the deck. */
+export function recordRestartFailure({ name = "agents-deck", command = null, error = null, version = null, at = Date.now() } = {}) {
+  const path = restartFailurePath(name);
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify({
+      command,
+      error: error ? String(error).slice(0, 300) : null,
+      // The version that failed to leave — see restartFailureNotice.
+      version,
+      at,
+    }));
+  } catch { /* ignore */ }
+}
+
+/** Called before each attempt, so a retry is answered by its own outcome rather
+ *  than by the last one's. */
+export function clearRestartFailure(name = "agents-deck") {
+  try { rmSync(restartFailurePath(name), { force: true }); } catch { /* ignore */ }
+}
+
+export function readRestartFailure(name = "agents-deck") {
+  try {
+    const m = JSON.parse(readFileSync(restartFailurePath(name), "utf8"));
+    return m && typeof m === "object" ? m : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The note as the version report should carry it, or null when it no longer
+ * describes this deck. Pure, because the staleness rule is the whole subtlety.
+ *
+ * The note names the version that was running when the upgrade failed. While
+ * that is still the version on disk, the failure is current: the deck really is
+ * stuck where it was. Once the files are a different version the upgrade
+ * happened some other way — a `npm i -g`, a fixed npm prefix, a manual npx —
+ * and a note about a deck that no longer exists must not keep claiming the
+ * update is broken.
+ */
+export function restartFailureNotice(record, installed = null) {
+  if (!record || typeof record.error !== "string" || !record.error) return null;
+  if (record.version && installed && record.version !== installed) return null;
+  return {
+    state: "failed",
+    command: typeof record.command === "string" ? record.command : null,
+    error: record.error,
+    at: typeof record.at === "number" ? record.at : 0,
+  };
+}
+
 // One install at a time, per process. State is deliberately coarse: the UI only
 // needs to know whether to show a spinner, a version, or an error.
 let _upgrade = { state: "idle", command: null, error: null, at: 0 };
@@ -642,6 +726,14 @@ export async function versionReport({ running, pkgRoot, name = "agents-deck", no
   const latest = skipRegistry ? null : await latestOnNpm(target, now, force);
   const marker = skipRegistry ? null : readMarker(target);
   const blocked = upgradeBlock(pkgRoot);
+  // An install started in THIS process outranks the note on disk: it is newer
+  // by construction, and a running one must not be reported as a past failure.
+  // The note is read whatever the registry is doing — it is a local event, not
+  // a lookup — so an offline deck still explains why its update did nothing.
+  const live = upgradeStatus();
+  const upgrade = live.state === "idle"
+    ? (restartFailureNotice(readRestartFailure(target), installed) ?? live)
+    : live;
   return {
     name: target,
     running: running ?? null,
@@ -669,6 +761,6 @@ export async function versionReport({ running, pkgRoot, name = "agents-deck", no
     // of the install, not of the update: upgradeMode says so.
     upgradeBlocked: blocked,
     upgradeMode: upgradeMode(blocked),
-    upgrade: upgradeStatus(),
+    upgrade,
   };
 }