agent-dag 3.22.0 → 3.22.3

package/src/server/args.mjs

@@ -1,183 +0,0 @@
-// The command line, parsed: everything the deck recognises, and everything it
-// does not.
-//
-// Its own module rather than a function inside bin/deck.js, for one reason —
-// importing bin/deck.js RUNS a deck. That file installs hooks, binds a port and
-// opens a browser at module scope, so there was no way to ask what `--prot`
-// parses to without starting a server to find out. Nothing here does any of
-// that: strings in, a plain object out, no I/O, no process, no terminal.
-//
-// bin/deck.js is the only caller. The parser is the whole of the module's
-// surface; the tables it matches against stay inside it.
-
-/**
- * Is this token a flag rather than somebody's value?
- *
- * A leading `-` and nothing else, because the alternatives are worse. Matching
- * the known flag list would refuse `--workspace --prot` — a typo eating the next
- * token is the same accident as a real flag eating it, and the one shape that
- * must be caught is the one nobody spelled right. Refusing every value that
- * begins with `-` would refuse `--port -1`, which is a number the user meant and
- * which deserves the port error below rather than a "missing value" one.
- *
- * So: a leading `-`, except a plain negative number. The negative-number carve
- * is the only exception, and it is small on purpose.
- *
- * WHAT THIS DOES ON EACH PLATFORM. Nothing, is the intent, to any real path.
- * POSIX absolute (`/srv/proj`), POSIX relative (`./sub`, `sub`), `~/proj`, a
- * Windows drive letter (`C:\Users\u\proj`, `c:/users/u/proj`), a UNC share
- * (`\\srv\share\proj`), a Windows long path (`\\?\C:\proj`) and a bare
- * `events.jsonl` all begin with something other than `-`, so all of them are
- * values. A drive letter is not a flag on any platform and is never read as one:
- * `C:` starts with `C`. What IS refused is a directory whose name really begins
- * with a dash, which the user can still pass as `./-weird` — a two-character
- * price for catching `--workspace $UNSET --no-persist`.
- */
-export function looksLikeFlag(token) {
-  return typeof token === "string" && token.startsWith("-") && !/^-\d+(?:\.\d+)?$/.test(token);
-}
-
-/**
- * Is this a port the deck could bind? Digits only, inside the range Node's
- * `listen` accepts.
- *
- * `Number()` alone is far too willing: it takes `" 4500 "`, `0x10e4`, `1e3` and
- * `Infinity`, and turns everything else into the `NaN` that used to reach
- * `listen` and die there. The whole point of asking here is to answer BEFORE the
- * deck has installed hooks and probed for tools, and to answer about the string
- * the user actually typed. See bin/deck.js, which prints the flag and the value
- * back at them.
- */
-export function isPortValue(raw) {
-  if (typeof raw !== "string" && typeof raw !== "number") return false;
-  const s = String(raw).trim();
-  if (!/^\d+$/.test(s)) return false;
-  const n = Number(s);
-  return n >= 0 && n <= 65535;
-}
-
-/**
- * Parse `process.argv.slice(2)`.
- *
- * Returns the flags that were set, plus two lists that are always present and
- * always arrays:
- *
- *   `unknown`     — every token the loop did not recognise, in the order it met
- *                   them. That list is the point of this module: the loop used
- *                   to have no `else`, so `ccdeck --prot 4500` booted on 4317 and
- *                   said nothing, and a typo was indistinguishable from a flag
- *                   that worked.
- *   `incomplete`  — every value-taking flag that was given no value it could
- *                   use, as `{ flag, expects }`, `flag` spelled the way the user
- *                   spelled it. bin/deck.js prints one row per entry.
- *
- * THE THREE FLAGS THAT TAKE A VALUE (`--port`/`-p`, `--workspace`, `--history`)
- * used to consume the next token with `args[++i]` whatever it was. That is right
- * for `--port 4500` — the value must never be re-examined as a token of its own,
- * or every correct command line would report its own port as an unknown option,
- * and a warning that fires on correct input is a warning everybody learns to
- * ignore. It was wrong for a value that is itself a flag (#697): `ccdeck
- * --workspace $PROJ --no-persist` with `PROJ` unset is, after word splitting,
- * `ccdeck --workspace --no-persist`. The deck scoped itself to a directory
- * called `--no-persist`, wrote to the shared events log anyway, and reported
- * neither — `unknown` stayed empty, because the token that would have gone in it
- * had been eaten.
- *
- * So the consume is conditional now, and it refuses three shapes:
- *
- *   * the next token looks like a flag — NOT consumed, so the loop meets it on
- *     the next pass and it is parsed as the flag it is, or reported as unknown.
- *     That is also what fixes the supervisor case in bin/agent-dag.js: a
- *     respawn appends `--port <bound>` to the user's argv, and an argv ending in
- *     a bare `--workspace` used to eat the `--port` and drop the deck back on
- *     4317, out from under the tab the user was looking at.
- *   * there is no next token at all — the trailing `--workspace`, which used to
- *     set `undefined` and mean "the default", silently.
- *   * the next token is empty or blank — consumed (it was quoted, so it was
- *     meant as the value) but not used. `--workspace ""` is a variable that did
- *     not expand, not a request for machine-wide capture, and answering it with
- *     the widest possible scope is the one answer that cannot be recovered from.
- *
- * In all three the flag is left UNSET, so the deck falls back to its documented
- * default, and the flag is named in `incomplete` so the fallback is said out
- * loud rather than discovered later.
- *
- * A bare word is `unknown` too, and deliberately: the deck takes no positional
- * arguments at all, so `ccdeck ~/proj` is the same mistake as `ccdeck --workpace
- * ~/proj` — something the deck read and then did nothing with. It is also how
- * an unquoted path with a space in it becomes visible, which is a failure this
- * repo already knew about and could not previously report: `--workspace
- * C:\Users\John Smith\proj` reaches the parser as two arguments, and the second
- * one used to be dropped in silence (see launchNpx in bin/agent-dag.js).
- */
-/**
- * The flags that do a thing and exit, rather than starting a deck.
- *
- * bin/agent-dag.js reads this before it decides whether to detach, and that is
- * the whole reason it exists as a list rather than as a condition written out
- * at the call site: a one-shot that detached would print its answer into a log
- * file and hand the terminal back empty. `ccdeck --version` detaching itself is
- * the shape of the bug this prevents.
- */
-export const ONE_SHOT = Object.freeze([
-  "help", "version", "uninstall", "stop", "status", "logs",
-  "install", "installService", "uninstallService",
-]);
-
-/** Is this a command line that answers and leaves? */
-export function isOneShot(flags = {}) {
-  return ONE_SHOT.some((k) => flags[k] === true);
-}
-
-export function parseArgs(args) {
-  const out = { unknown: [], incomplete: [] };
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    // The value of the flag just matched, or `undefined` when there is nothing
-    // usable there. Closes over `i` so it can decline to advance it: not
-    // consuming is what hands the token back to the loop.
-    const value = (expects) => {
-      const next = args[i + 1];
-      if (next === undefined || looksLikeFlag(next)) {
-        out.incomplete.push({ flag: a, expects });
-        return undefined;
-      }
-      i++;
-      if (String(next).trim() === "") {
-        out.incomplete.push({ flag: a, expects });
-        return undefined;
-      }
-      return next;
-    };
-    // Assigned only when there is a value, so an unusable one leaves the key
-    // absent and the deck on its default — see the doc comment.
-    const set = (key, expects) => {
-      const v = value(expects);
-      if (v !== undefined) out[key] = v;
-    };
-    if (a === "-h" || a === "--help") out.help = true;
-    else if (a === "-v" || a === "--version") out.version = true;
-    else if (a === "-p" || a === "--port") set("port", "a port number");
-    else if (a === "--no-open") out.noOpen = true;
-    else if (a === "--new") out.new = true;
-    else if (a === "--foreground") out.foreground = true;
-    else if (a === "--stop") out.stop = true;
-    else if (a === "--status") out.status = true;
-    else if (a === "--logs") out.logs = true;
-    else if (a === "--install") out.install = true;
-    else if (a === "--install-service") out.installService = true;
-    else if (a === "--uninstall-service") out.uninstallService = true;
-    else if (a === "--uninstall") out.uninstall = true;
-    else if (a === "--workspace") set("workspace", "a path");
-    else if (a === "--scope") out.scope = true;
-    else if (a === "--all") out.all = true; // legacy no-op (now default)
-    else if (a === "--no-persist") out.noPersist = true;
-    else if (a === "--history") set("history", "a path");
-    else if (a === "--codex") out.codex = true;
-    else if (a === "--no-codex") out.noCodex = true;
-    else if (a === "--claude") out.claude = true;
-    else if (a === "--no-claude") out.noClaude = true;
-    else out.unknown.push(a);
-  }
-  return out;
-}

package/src/server/auto-update.mjs

@@ -1,79 +0,0 @@
-// Updating the deck while nobody is looking at it.
-//
-// The update path had one automatic step, and it needed a page: the banner's
-// `auto when idle` restarted the deck once an install had landed, and only in a
-// tab somebody was looking at. An install itself never happened unless a person
-// pressed `Update now`, and a deck with no tab open stayed on its old code for
-// good. Since 3.20.0 the deck outlives its terminal and runs for days with no
-// tab at all, which made that the common case.
-//
-// So the server does it, at the one moment it cannot interrupt anybody: no tab
-// has focus (presence.mjs), no agent is mid-turn, and no turn has produced an
-// event for AWAY_QUIET_MS (activity.mjs). The same switch governs it — the
-// banner's `auto when idle`, kept in prefs.json as `autoUpdate` now so the
-// server can read it with no page open. A person looking at the deck still gets
-// the banner and its buttons; this is only for when they are not.
-//
-// Every effect goes through the code a press uses — startUpgrade, and the
-// launcher's restart — so an unattended update cannot do anything a person
-// could not have done from the banner. Pure rules here; index.mjs owns the
-// timer and the effects.
-
-/** Quiet before the deck may act: the page's IDLE_BEFORE_RESTART_MS, so the
- *  two paths agree on what idle means. */
-export const AWAY_QUIET_MS = 30_000;
-
-/** How long a deck that has just started waits before acting at all. A
- *  relaunch that came back on the version it left would otherwise try again a
- *  minute later, and again after that; this caps any such loop at one attempt
- *  per boot grace, under the launcher's own two-strike rule for npx
- *  (supervisor.mjs, upgradeAttempt). */
-export const AWAY_BOOT_GRACE_MS = 5 * 60_000;
-
-/** How long the same attempt is left alone after it was made: an install that
- *  failed, a fetch the launcher refused, a restart it could not run. A newer
- *  version is a different attempt and is not held back by this. */
-export const AWAY_RETRY_MS = 30 * 60_000;
-
-/** How often the server asks. The gate below is answered from memory; only
- *  when it passes does the tick read the version report, which touches disk. */
-export const AWAY_TICK_MS = 60_000;
-
-/** How long a report that found nothing newer is taken as the answer. The npm
- *  lookup behind it is hourly anyway, and the report is not free: on Windows
- *  upgradeBlock proves the npm prefix writable by creating a file in it, and a
- *  deck left alone overnight would otherwise do that once a minute. */
-export const AWAY_RECHECK_MS = 5 * 60_000;
-
-/**
- * Whether the deck may consider updating itself right now. Every input is
- * already in memory, so this runs every tick at no cost.
- */
-export function awayGate({
-  enabled, supervised, restarting, sinceBootMs, looking, busy, quietMs,
-  graceMs = AWAY_BOOT_GRACE_MS, quietNeedMs = AWAY_QUIET_MS,
-}) {
-  return enabled === true && supervised === true && !restarting
-    && sinceBootMs >= graceMs && !looking && !busy && quietMs >= quietNeedMs;
-}
-
-/**
- * What to do about the version report, once the gate has passed.
- *
- *   restart  the newer code is already on disk (an install landed, or a
- *            checkout was pulled) — the free half, as pickNotice says
- *   install  `npm i -g` over a global install; the next tick restarts into it
- *   npx      the launcher fetches the new version and hands it the port
- *   null     nothing newer, an install already running, the same attempt
- *            made too recently, or a copy that only a person can update
- */
-export function awayUpdateStep({ notice, mode, installing, lastTry, now, retryMs = AWAY_RETRY_MS }) {
-  if (!notice || installing) return { act: null };
-  const target = `${notice.kind}:${notice.to}`;
-  // A clock that moved backwards counts as time elapsed, as everywhere else in
-  // the update path: a deck must not wait out a window it cannot measure.
-  if (lastTry?.target === target && now >= lastTry.at && now - lastTry.at < retryMs) return { act: null, target };
-  if (notice.kind === "restart") return { act: "restart", target };
-  if (notice.kind === "upgrade" && (mode === "install" || mode === "npx")) return { act: mode, target };
-  return { act: null, target };
-}

package/src/server/block-notify.mjs

@@ -1,173 +0,0 @@
-// The half of "which agent is waiting on you" that no page can answer.
-//
-// The tab-side notifier (src/web/notify.ts) covers a deck that is open and
-// hidden — behind another window, on another desktop, in a tab you have not
-// looked at since lunch. It cannot cover the deck that is not open at all,
-// because raising a notification from a page requires a page, and the case this
-// whole feature exists for is the one where you walked away.
-//
-// The server can, and it already knows the one fact that makes it safe to:
-// `sseClients.size`. Nobody is listening means nobody is being told by any
-// other surface — the chip, the title, the favicon and the live region are all
-// drawn inside a document that does not exist right now — so a notification
-// here cannot duplicate one of them, and cannot arrive over a page the user is
-// looking at. The two notifiers are exclusive by construction rather than by
-// coordination, which is why neither has to know about the other.
-//
-// WHAT THIS DOES NOT DO IS DECIDE ANYTHING ABOUT AN AGENT. It reads one hook
-// event and raises a desktop notification. The hook script still exits 0
-// without writing to stdout, the deck still cannot allow, deny, defer or
-// rewrite a tool call, and `hook-read-only.test.ts` still holds that. The
-// distinction matters because "the deck notices your agent stopped" and "the
-// deck answers for your agent" are one keystroke apart in this codebase and
-// only one of them is a thing this product promises.
-//
-// Pure decisions here, the OS call injected, for the reason the web modules
-// give: what the suite cannot run is what drifts. `notify` comes from
-// browser-react.mjs, which already ships this on all three platforms for
-// Browser Watch — osascript with argv on macOS, a WinRT toast on Windows,
-// notify-send on Linux — so the platform work is done and tested and this is
-// the second caller rather than a second implementation.
-import { basename } from "node:path";
-
-/** Set `AGENTS_DECK_NO_NOTIFY=1` to keep the deck off the desktop entirely.
- *  Same shape as AGENTS_DECK_NO_DOWNLOAD and AGENTS_DECK_NO_INSTALL, which is
- *  the sheet of switches a user already knows to look for. */
-export const OFF_ENV = "AGENTS_DECK_NO_NOTIFY";
-
-/**
- * How long one session stays quiet after it has been announced.
- *
- * The tab-side notifier keys its dedupe on `since`, which it can do because the
- * reducer refuses to re-stamp that field. Nothing here has a reducer: this sees
- * raw hook events, one at a time, and the same permission prompt can reach it
- * more than once — a hook retried, a deck replaying somebody else's log into
- * `POST /api/event`, or CC re-notifying about a prompt still standing.
- *
- * So the memo is a cooldown rather than an identity. Two minutes is chosen
- * against what it costs to be wrong in each direction: too short and one
- * unanswered prompt drums; too long and a genuinely new prompt on a busy
- * session is swallowed. A prompt answered inside two minutes did not need the
- * notification, and one that is still standing after two minutes is worth
- * saying again to somebody who is, by construction, not looking at a screen
- * that says it.
- */
-export const QUIET_MS = 2 * 60 * 1000;
-
-/**
- * The events that mean a session has stopped and cannot start again without a
- * human. Two of the three kinds CC emits.
- *
- * `permission_prompt` — it wants to run something and is waiting to be allowed.
- *
- * `agent_needs_input` — it asked a question and is waiting for the answer, with
- * the question itself in `message`. This was missing, and its absence was not a
- * small gap: on a machine running `bypassPermissions` Claude Code never asks to
- * run anything, so `permission_prompt` essentially never fires and the desktop
- * notification could not happen at all. Measured on one real log — 1683 events,
- * every one of them bypassPermissions — a single permission prompt in the whole
- * history against five of these.
- *
- * `idle_prompt` is deliberately still out: #348 measured 16 idle to 5
- * permission, and an idle prompt is a turn that ended, not a session that is
- * stuck. Three quarters noise is how a notification channel gets muted, and a
- * muted channel is worse than none because the deck goes on believing it told
- * somebody.
- */
-export function isBlockingPrompt(raw) {
-  return !!raw
-    && raw.hook_event_name === "Notification"
-    && (raw.notification_type === "permission_prompt"
-      || raw.notification_type === "agent_needs_input");
-}
-
-/**
- * What to put on the desktop.
- *
- * The title is the working directory's last segment, because that is what the
- * user calls the thing — "vcrm-core", not a UUID — and because a notification
- * title is the only line no platform truncates. The deck's own name goes in it
- * too: this arrives with no window and no tab beside it to say where it came
- * from, which is the one context the in-page notifier never has to supply.
- *
- * The body is CC's sentence, verbatim and alone. The tool guess that the tab
- * shows is deliberately absent: it is inferred by the REDUCER from the newest
- * call still in flight, and nothing on this side of the wire tracks in-flight
- * calls. Rebuilding that here to fill a notification body would be a second,
- * dimmer copy of a rule that already exists — the failure ambient-counts.ts and
- * block-announce.ts were both written to end.
- */
-export function blockNotice(raw, product) {
-  const cwd = typeof raw.cwd === "string" && raw.cwd ? basename(raw.cwd) : "";
-  const who = cwd || (typeof raw.session_id === "string" ? raw.session_id.slice(0, 8) : "a session");
-  const said = typeof raw.message === "string" && raw.message ? raw.message : "Needs your permission";
-  return { title: `${who} — ${product}`, body: said };
-}
-
-/**
- * Should this event put something on the desktop?
- *
- * Four gates, and three of them are about a burst rather than a single
- * notification — a channel that fires twelve times in a second is one the user
- * turns off within the minute:
- *
- *   - a blocking prompt, per `isBlockingPrompt`
- *   - NOTHING LISTENING. A page is a better surface than this in every way, so
- *     wherever there is one, this stays out of the way.
- *   - NOT A REPLAY. The server replays events.jsonl into itself at boot to
- *     rebuild the ring, and that log holds every permission prompt of the last
- *     50MB. Without this gate, starting the deck would announce the entire
- *     history of the machine at once.
- *   - the session has not just been announced, per `QUIET_MS`.
- */
-export function shouldNotify(raw, { clients, replay, lastAt, now }) {
-  if (!isBlockingPrompt(raw)) return false;
-  if (clients > 0) return false;
-  if (replay) return false;
-  if (lastAt != null && now - lastAt < QUIET_MS) return false;
-  return true;
-}
-
-/**
- * The stateful wrapper index.mjs holds: the per-session memo, and the call out
- * to the OS.
- *
- * `notify` and `now` are injected so the suite drives this without a desktop
- * and without a clock.
- *
- * `enabled` USED TO BE READ ONCE at construction, on the argument that a switch
- * changing under a running process is one two events in the same second can
- * disagree about. That was right while the only way to set it was an
- * environment variable, which cannot change under a running process at all. It
- * is a user-facing switch now — deck-prefs.mjs, flipped from the sound menu —
- * and a mute that only takes effect after a restart is not a mute. So it may be
- * a function, asked per event; two events in the same second disagreeing is the
- * correct behaviour when somebody pressed the switch between them.
- */
-export function createBlockNotifier({ notify, product, now = Date.now, enabled = true, onError }) {
-  const isEnabled = typeof enabled === "function" ? enabled : () => enabled;
-  /** session_id → when it was last announced. Bounded by pruning on read: a
-   *  long-lived server sees many sessions and this must not become a second
-   *  ring nobody empties. */
-  const seen = new Map();
-
-  return {
-    /** Returns what it did, for the tests and for nothing else. */
-    consider(raw, { clients, replay = false }) {
-      if (!isEnabled()) return "off";
-      const at = now();
-      const id = raw?.session_id ?? "";
-      if (!shouldNotify(raw, { clients, replay, lastAt: seen.get(id), now: at })) return "skipped";
-      seen.set(id, at);
-      for (const [key, when] of seen) if (at - when > QUIET_MS) seen.delete(key);
-      const { title, body } = blockNotice(raw, product);
-      // Fire-and-forget, and the catch is not decoration. `notify` shells out —
-      // osascript, PowerShell, notify-send — and on a Linux box with no
-      // notification daemon the last of those simply is not there. A rejected
-      // promise from a notification must never take down the ingest path that
-      // every hook event in the process goes through.
-      Promise.resolve(notify(title, body)).catch(err => onError?.(err));
-      return "notified";
-    },
-  };
-}

package/src/server/boot-deadline.mjs

@@ -1,127 +0,0 @@
-// The boot has a deadline, and the jobs under it do not get to decide it.
-//
-// #742. Two people on two operating systems reported the same thing: `npx
-// ccdeck`, the wordmark, four rows, then a spinner at "checking claude-swap…"
-// and nothing — no "server ready", no browser, no way to tell a slow machine
-// from a dead one. The port was open the whole time. What they were watching
-// was `reportStartup` awaiting `ensureCswap`, which on a machine that has
-// neither claude-swap nor a Python toolchain downloads a uv binary under a
-// 120-second deadline and then runs `uv tool install claude-swap` under a
-// 180-second one. Five minutes, worst case, before the line that says where to
-// point a browser — for a panel that is optional and that nobody asked for
-// during that boot.
-//
-// The install itself is not the bug and is not cancelled here. What was wrong
-// is that the boot waited for it. So every job whose failure is not fatal is
-// given a slice of the boot rather than the whole of it, and a job that is
-// still working when its slice runs out is SAID SO and left running. The row it
-// would have printed is printed later, when it settles, which is the same
-// contract the deck already has with its background upgrade.
-//
-// bin/deck.js's `update` job has raced a timer since it was written — this is
-// that idea, given a name and the one thing the inline race could not do: tell
-// "the job answered null" apart from "the job did not answer", which for
-// claude-swap is the difference between "not installed" and "still installing".
-
-/** How long the whole report may spend waiting on jobs that are not fatal.
- *
- *  Eight seconds is chosen from the two ends it sits between. Below it are the
- *  probes a normal boot really does pay — `cswap --version`, `uv --version`,
- *  a PyPI lookup — which finish in well under a second on a warm machine and in
- *  two or three on a cold one behind a slow DNS; a deadline under that would
- *  turn every honest boot into a background one and the rows would stop being
- *  where a reader looks for them. Above it is the only thing the deadline
- *  exists to bound, and that one is measured in minutes, so there is no value
- *  in the middle that anybody would notice being wrong. */
-export const BOOT_DEADLINE_MS = 8_000;
-
-/**
- * The deadline, as the environment may override it.
- *
- * Tests need a boot they can watch inside a test budget, and a test that has to
- * wait eight real seconds to prove the deadline works is a test that costs the
- * suite eight seconds forever. Read from the environment rather than passed
- * down through four call sites for one caller that is not the product.
- *
- * Anything unparseable, negative, or absent is the default. Zero is honoured —
- * "give the jobs nothing" is a coherent thing for a test to ask for, and the
- * timer path below still runs, so it exercises the same code the product does.
- */
-export function bootDeadlineMs(env = process.env) {
-  const raw = env.AGENTS_DECK_BOOT_DEADLINE_MS;
-  if (raw === undefined || raw === "") return BOOT_DEADLINE_MS;
-  const n = Number(raw);
-  return Number.isFinite(n) && n >= 0 ? n : BOOT_DEADLINE_MS;
-}
-
-/**
- * Await `work`, but never past `ms`.
- *
- * Answers `{ done: true, value }` or `{ done: false, value: undefined }`. A
- * shape rather than a sentinel value, because three of the jobs this wraps
- * resolve to `null` on purpose — "not attempted" is a real answer and must not
- * read as "ran out of time".
- *
- * A rejection is a settled job, not a timeout: `{ done: true, value: undefined
- * }`. Every caller here already attached its own rejection handler at the point
- * the promise was created, so the throw has been dealt with and what is left to
- * decide is only whether to keep waiting. Re-throwing would turn a job that
- * failed politely into a boot that died.
- *
- * The timer is cleared the moment the job settles, so a boot whose jobs all
- * answer at once does not hold the event loop for the rest of the deadline.
- *
- * It is deliberately NOT unref'd. An unref'd deadline is a deadline that does
- * not fire when the only thing left in the process is the deadline itself —
- * which is exactly the shape of a test that awaits nothing else, and would have
- * made this function pass by exiting rather than by working. The cost of
- * keeping it is at most one deadline's worth of a process that was about to
- * end, against a deck that runs until Ctrl+C.
- */
-export function within(work, ms, { setTimer = setTimeout, clearTimer = clearTimeout } = {}) {
-  return new Promise(resolve => {
-    let answered = false;
-    const timer = setTimer(() => {
-      if (answered) return;
-      answered = true;
-      resolve({ done: false, value: undefined });
-    }, ms);
-    Promise.resolve(work).then(
-      value => {
-        if (answered) return;
-        answered = true;
-        clearTimer(timer);
-        resolve({ done: true, value });
-      },
-      () => {
-        if (answered) return;
-        answered = true;
-        clearTimer(timer);
-        resolve({ done: true, value: undefined });
-      },
-    );
-  });
-}
-
-/**
- * A deadline shared by everything that draws on it, in the order they are
- * awaited.
- *
- * One budget for the whole report rather than one each, because the rows are
- * awaited in sequence and per-job deadlines would multiply: four jobs at eight
- * seconds is a thirty-two second boot that every individual deadline would call
- * within its budget. What a reader was promised is that the deck is ready
- * within the deadline, and that promise is about the sum.
- *
- * `left()` never goes below zero, so a job reached after the budget is spent is
- * given a zero-length slice and reported as still working — which it is.
- */
-export function budget(ms, now = Date.now) {
-  const started = now();
-  return {
-    left: () => Math.max(0, ms - (now() - started)),
-    spent: () => now() - started,
-    /** Await `work` against whatever is left. */
-    within: (work, deps) => within(work, Math.max(0, ms - (now() - started)), deps),
-  };
-}

package/src/server/brand.mjs

@@ -1,16 +0,0 @@
-// The name the server prints, in one place — the console half of what
-// src/web/brand.ts holds for the browser and src/server/term.mjs draws as the
-// banner wordmark. Every `PRODUCT:` prefix below is a line a user reads when
-// something has already gone wrong, which is the worst moment to introduce
-// yourself by a name that appears nowhere else they have seen.
-//
-// Display name only. The package published to npm is still `agents-deck`, so
-// self-update.mjs's `name` defaults stay as they are — that string is what the
-// registry is queried for and what `npm i -g` installs, and an install that
-// names the product instead of the package installs nothing. Same for the
-// marker files under ~/.agents-deck, the event log under ~/.claude/agent-dag,
-// the AGENTS_DECK_* variables and the `user-agent` headers: identifiers outlive
-// a rename, and moving one orphans a running deck from its own state.
-
-/** The prefix on every line the deck writes to a console or a log. */
-export const PRODUCT = "ccdeck";