agent-dag 1.43.0 → 1.44.1

package/src/server/invoked-as.mjs

@@ -1,11 +1,11 @@
 // Which of the three published commands the user typed — and nothing else.
 //
-// The deck is on npm three times over: `agents-deck` (what this repo publishes),
-// `agent-dag` (the same tarball under the name it shipped as first) and
-// `ccdeck` (a stub that depends on agents-deck and spawns its bin). Every
-// surface a human reads says ccdeck now, and 95% of the downloads are still on
-// the other two, so nothing closes that split on its own. This file is the
-// evidence behind saying so — once in the terminal, once in the browser.
+// The deck is on npm three times over — `ccdeck`, `agents-deck` and `agent-dag`
+// — and since #340 all three are literally the same tarball, published with
+// `name` set to each in turn. Every surface a human reads says ccdeck now, and
+// most of the downloads are still on the other two, so nothing closes that split
+// on its own. This file is the evidence behind saying so — once in the terminal,
+// once in the browser.
 //
 // Two rules make that safe, and they are the whole of the file.
 //
@@ -15,13 +15,15 @@
 // dead on the one machine where the deck was the thing that would have
 // explained why.
 //
-// And it is never asked of the PACKAGE. `ccdeck/package.json` depends on
-// `agents-deck`, and `ccdeck/bin/ccdeck.js` spawns
-// `../../agents-deck/bin/agent-dag.js` — so "is this build agents-deck?" is
-// true inside every ccdeck run, and a notice keyed on it would scold exactly
-// the people who did what we asked. The question is which name the USER TYPED.
-// That is a different question, with a different answer, and on one platform
-// with no answer at all:
+// And it is never asked of the PACKAGE. That was unarguable while ccdeck was a
+// stub — it depended on `agents-deck` and spawned its bin, so "is this build
+// agents-deck?" was true inside every ccdeck run, and a notice keyed on it would
+// have scolded exactly the people who did what we asked. #340 removed the stub
+// and the rule outlived it, because the three names are now ONE tarball: asking
+// the package what it is gets you whichever name the publish step happened to
+// set last, which is not evidence about the user at all. The question is which
+// name the USER TYPED. That is a different question, with a different answer,
+// and on one platform with no answer at all:
 //
 //   npx, everywhere — npm writes the literal spec into
 //     `_npx/<hash>/package.json` as `_npx.packages`, which npxRestartSpec
@@ -37,7 +39,7 @@
 //
 //   a global install on Windows — nowhere. npm writes <name>.cmd, <name>.ps1
 //     and an extensionless sh shim, each of which runs
-//     `node "…\node_modules\agents-deck\bin\agent-dag.js" %*` (npm's cmd-shim).
+//     `node "…\node_modules\<pkg>\bin\agent-dag.js" %*` (npm's cmd-shim).
 //     The typed name is the shim's FILENAME and never becomes an argument, and
 //     there is no other carrier — npm_config_user_agent and friends are not set
 //     for a direct bin invocation. So Windows answers null.

package/src/server/quota.mjs

@@ -29,7 +29,7 @@
 // cooldown; 1 is not, because it is a local file read.
 import { activeAccountUsage, requestCollection } from "./claude-accounts.mjs";
 import { claudeCliCandidates, claudeConfigDir } from "./claude-dir.mjs";
-import { run } from "./exec.mjs";
+import { pathLookup, run } from "./exec.mjs";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
@@ -174,6 +174,11 @@ let _cacheAt  = 0;
 let _inflight = null;   // deduplicates concurrent CLI probes
 let _lastGood = null;   // last result that had real quota percentages
 let _lastSelfPollAt = 0;
+// Which account the readings below are about — as a counter, because the
+// account's identity is not something this module holds. invalidateQuotaCache
+// bumps it; every write in _doFetch is stamped with the value that was current
+// when that read STARTED. See publish().
+let _generation = 0;
 
 const CACHE_MS = 60_000;
 
@@ -356,15 +361,69 @@ function parseUsageText(raw) {
  *
  *  Exported, with everything it touches injectable, so the Windows branch is
  *  testable from the platforms this repo is actually developed on.
+ *
+ *  WHY THE BARE NAME HAS TO EARN ITS PLACE (#553). This used to be a `.find`
+ *  over `!c.includes(sep) || exists(c)`, which reads as "a bare name always
+ *  answers, a full path only when it is there". On Windows that is harmless —
+ *  the bare name is LAST in the list — but on POSIX it is FIRST, so the `||`
+ *  short-circuited on candidate one and `exists` was never called even once:
+ *  `~/.local/bin/claude`, `/usr/local/bin/claude` and `/opt/homebrew/bin/claude`
+ *  were in a list nothing ever read. The user this broke is the one
+ *  claude-dir.mjs names out loud: Claude Code installed by the official
+ *  installer, so the binary is at `~/.local/bin/claude`, and the deck launched
+ *  from something whose PATH never sourced a shell rc — a LaunchAgent, a
+ *  systemd user unit, pm2, a desktop shortcut. `hasClaudeInstalled()` stats the
+ *  absolute paths and says yes, so hooks install and the Claude surface turns
+ *  on; every `claude --print /usage` spawn is then a bare-name ENOENT logged as
+ *  `quota: claude CLI failed`. On macOS there is no `.credentials.json` to fall
+ *  back to (the token is in the Keychain, #360), so the quota panel simply stays
+ *  dark on a machine that plainly has Claude Code. The identical install on
+ *  Windows worked, because there the ordering already said what this now says.
+ *
+ *  WHICH WINS. The candidate list's own order decides, unchanged on both
+ *  platforms — PATH first on POSIX, the two known install directories first on
+ *  Windows — because the ordering question here is the one getRunner in
+ *  ccusage.mjs already answered: preferring a different copy would silently
+ *  change which binary runs on every machine that has two, and a deck that
+ *  works today must not start running a `claude` it has never run. A user with
+ *  a current claude on PATH via nvm/mise/volta and a stale one left in
+ *  `~/.local/bin` keeps getting the one their own shell gives them. All that
+ *  changes is that a bare name is now only ANSWERED WITH when PATH actually
+ *  holds it, which is the same rule claudeCliOnDisk in claude-dir.mjs has
+ *  always applied to this very list — the two readers of one list can no longer
+ *  disagree about whether the deck can run what it says is installed.
+ *
+ *  WHAT IT COSTS. One PATH walk, stopping at the first hit, and only for the
+ *  bare candidate; the absolute paths are stat'ed only once PATH has come up
+ *  empty. That is the trade ccusage.mjs already priced for the same shape of
+ *  question — "a handful of stats, once per uncached fetch, against a process
+ *  spawn that follows it" — and here the spawn that follows is a whole Claude
+ *  Code process measured at ~3s, behind the SELF_POLL_MS floor.
+ *
+ *  `pathLookup` is used as a yes/no gate rather than for the path it found, on
+ *  purpose: answering with the bare name keeps spawn's own resolution (and, on
+ *  Windows, exec.mjs's PATHEXT candidate walk) in charge of the PATH case
+ *  exactly as before, so a PATH entry that merely LOOKS like a hit — a
+ *  directory named `claude` — cannot become the answer.
  */
 export function quotaClaudeBin(platform = process.platform, env = process.env,
                                home = homedir(), exists = existsSync) {
   const sep = platform === "win32" ? "\\" : "/";
-  // A bare name is left to spawn's own PATH lookup (and, on Windows, to the
-  // PATHEXT walk exec.mjs does by hand); a full path is only worth naming when
-  // it is actually there.
-  return claudeCliCandidates(platform, env, home)
-    .find(c => !c.includes(sep) || exists(c)) ?? "claude";
+  // process.env is case-insensitive on Windows; an injected plain object in a
+  // test is not, and %Path% is how the variable is actually spelled there.
+  const pathEnv = env.PATH ?? env.Path ?? env.path ?? "";
+  for (const c of claudeCliCandidates(platform, env, home)) {
+    // A full path is worth a single stat; a bare name means "ask PATH", which
+    // is pathLookup's walk — PATHEXT included, since `claude` on Windows is
+    // spelled `claude.exe` or `claude.cmd` and never the bare word.
+    if (c.includes(sep)) { if (exists(c)) return c; }
+    else if (pathLookup(c, platform, { pathEnv, exists })) return c;
+  }
+  // Nothing on PATH and nothing at any known install directory. The bare name
+  // is still the right last resort — POSIX `execvp` and cmd.exe's own search
+  // both deserve their turn at a layout no list here knows — and the ENOENT it
+  // produces is what `quota: claude CLI failed` reports.
+  return "claude";
 }
 
 export async function fetchClaudeQuota({ force = false } = {}) {
@@ -376,8 +435,44 @@ export async function fetchClaudeQuota({ force = false } = {}) {
   // good result with 0%).
   if (_inflight) return _inflight;
 
-  _inflight = _doFetch(now, force).finally(() => { _inflight = null; });
-  return _inflight;
+  // `_inflight === mine` rather than a bare clear: invalidateQuotaCache drops
+  // `_inflight` so the next caller starts a read that knows the account moved,
+  // and that read installs its own promise here. A read from before the switch
+  // finishing afterwards would otherwise clear the NEW one on its way out,
+  // letting a third caller spawn a second concurrent probe — which is the very
+  // thing this slot exists to prevent.
+  const mine = _doFetch(now, force, _generation)
+    .finally(() => { if (_inflight === mine) _inflight = null; });
+  _inflight = mine;
+  return mine;
+}
+
+/**
+ * Write a reading into the caches, unless the account moved while it was being
+ * taken.
+ *
+ * Every one of _doFetch's writes happens after at least one await — a store
+ * read, a 15-second HTTPS call, up to three `claude --print /usage` spawns with
+ * 1.2s between them — and invalidateQuotaCache clears variables, which does
+ * nothing to a function that is already running and still holds the old
+ * account's answer in a local. So a switch landing mid-flight was followed,
+ * milliseconds later, by the pre-switch reading being written straight back over
+ * the cleared cache: the invalidation looked like it worked and was undone
+ * before anyone could observe it.
+ *
+ * The fetch is deliberately NOT cancelled. Whoever asked for it is still owed an
+ * answer, and the reading is not wrong — it is simply about an account that is
+ * no longer active, which makes it a fine return value and a bad cached one.
+ * `_lastGood` gets the same guard, and needs it more: it is the half that
+ * survives the result cache's minute and comes back under a "stale" label for as
+ * long as the store has nothing to say about the new account.
+ */
+function publish(gen, result, at, { good = false } = {}) {
+  if (gen !== _generation) return result;
+  _cache   = result;
+  _cacheAt = at;
+  if (good) _lastGood = result;
+  return result;
 }
 
 /**
@@ -456,7 +551,7 @@ async function _execOnce(bin) {
   return { cliOk, parsed: parseUsageText(combined) };
 }
 
-async function _doFetch(now, force = false) {
+async function _doFetch(now, force = false, gen = _generation) {
   // Source 1: claude-swap's store. Free, and already paid for.
   let store = await storeQuota();
 
@@ -473,9 +568,7 @@ async function _doFetch(now, force = false) {
     // throttle inside is shared with the accounts panel, so two open panels
     // ask no more often than one.
     if (!force) requestCollection().catch(() => {});
-    _cache = store; _cacheAt = now;
-    _lastGood = store;
-    return store;
+    return publish(gen, store, now, { good: true });
   }
 
   // Nothing usable in the store. Everything below spends the user's budget, so
@@ -488,24 +581,16 @@ async function _doFetch(now, force = false) {
     // and then reverted to 23% (from a 48-minute-old store row) on the very
     // next poll, because the store had not moved.
     const held = freshest(store, _lastGood);
-    if (held) {
-      const result = { ...held, stale: true };
-      _cache = result; _cacheAt = now;
-      return result;
-    }
+    if (held) return publish(gen, { ...held, stale: true }, now);
     const result = { ok: false, reason: now < _rateLimitedUntil ? "rate_limited" : "waiting", fetchedAt: now };
-    _cache = result; _cacheAt = now - (CACHE_MS - 5_000);
-    return result;
+    return publish(gen, result, now - (CACHE_MS - 5_000));
   }
   _lastSelfPollAt = now;
 
   // Source 2: OAuth usage API — instant, exact, no cold-start gap.
   const api = await fetchOAuthUsage();
   if (api) {
-    const result = { ok: true, ...api, source: "api", fetchedAt: now };
-    _cache = result; _cacheAt = now;
-    _lastGood = result;
-    return result;
+    return publish(gen, { ok: true, ...api, source: "api", fetchedAt: now }, now, { good: true });
   }
 
   // Source 3: parse `claude --print /usage` CLI output.
@@ -526,10 +611,7 @@ async function _doFetch(now, force = false) {
 
   // Got real quota lines — cache normally and remember as last-known-good.
   if (parsed) {
-    const result = { ok: true, ...parsed, source: "cli", fetchedAt: now };
-    _cache = result; _cacheAt = now;
-    _lastGood = result;
-    return result;
+    return publish(gen, { ok: true, ...parsed, source: "cli", fetchedAt: now }, now, { good: true });
   }
 
   // No quota lines after retries. If we've ever seen real values, keep showing
@@ -540,10 +622,7 @@ async function _doFetch(now, force = false) {
   // vouches for numbers this branch already knows are stale. Short-cache so we
   // retry the CLI again soon.
   if (_lastGood) {
-    const result = { ..._lastGood, stale: true };
-    _cache = result;
-    _cacheAt = now - (CACHE_MS - 5_000);
-    return result;
+    return publish(gen, { ..._lastGood, stale: true }, now - (CACHE_MS - 5_000));
   }
 
   // Never had good data. CLI ran but lines absent → treat as genuine <1%.
@@ -552,9 +631,7 @@ async function _doFetch(now, force = false) {
     ? { ok: true, session5hPct: 0, session5hWindowSec: 18000,
         week7dPct: 0, week7dWindowSec: 604800, fetchedAt: now }
     : { ok: false, fetchedAt: now };
-  _cache = result;
-  _cacheAt = now - (CACHE_MS - 5_000);
-  return result;
+  return publish(gen, result, now - (CACHE_MS - 5_000));
 }
 
 /**
@@ -579,9 +656,29 @@ async function _doFetch(now, force = false) {
  * the shared request budget, and one that reset it would make switching a way to
  * hammer it. Until the store answers for the new account, "no reading yet" is
  * the honest thing to serve.
+ *
+ * Clearing the three variables is not enough on its own, because a fetch that is
+ * already running is not a variable. `_doFetch` writes `_cache` and `_lastGood`
+ * AFTER its awaits, so one that read the store before the switch and resolves
+ * after it put the previous account's numbers back into both, undoing this call
+ * from the other side of an await — and callers arriving in that window were
+ * handed the same in-flight promise rather than a read that knows the account
+ * moved. The window is real: a forced fetch goes through nudgeAndReread, which
+ * sleeps REREAD_TRIES * REREAD_GAP_MS = 2.4 seconds by construction, comfortably
+ * longer than a `cswap switch`.
+ *
+ * So the generation counter moves too. Every write in `_doFetch` is stamped with
+ * the generation that was current when that read started, and publish() drops
+ * any write whose stamp is stale — the fetch still resolves, and whoever asked
+ * for it still gets its answer, but that answer no longer becomes this module's.
+ * `_inflight` is released for the same reason: the next caller must start a read
+ * of its own rather than join one that is describing the account the deck just
+ * left.
  */
 export function invalidateQuotaCache() {
   _cache = null;
   _cacheAt = 0;
   _lastGood = null;
+  _generation++;
+  _inflight = null;
 }