npm - agent-dag - Versions diffs - 3.7.1 → 3.8.1 - Mend

agent-dag 3.7.1 → 3.8.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/dist/web/assets/{index-Cc7GEg4Y.js → index-sRuhstwH.js} +39 -35
package/dist/web/index.html +1 -1
package/package.json +1 -1
package/release-notes.json +12 -0
package/src/server/block-notify.mjs +12 -4
package/src/server/browser-react.mjs +33 -4
package/src/server/deck-prefs.mjs +129 -0
package/src/server/index.mjs +58 -2

package/dist/web/index.html CHANGED Viewed

@@ -40,7 +40,7 @@
         document.documentElement.setAttribute("data-theme", stored === "light" ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-Cc7GEg4Y.js"></script>
+    <script type="module" crossorigin src="/assets/index-sRuhstwH.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-ByAgTqB8.css">
   </head>
   <body>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "3.7.1",
+  "version": "3.8.1",
   "description": "Live deck of Claude Code and Codex agents — watch tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json CHANGED Viewed

@@ -31,6 +31,18 @@
     "about a defect in the type, and the suite refuses both it and no space at",
     "all."
   ],
+  "3.8.1": [
+    {
+      "title": "\ud83d\udd12 Security: update if the deck runs on a Mac",
+      "body": "A local process able to reach the deck's port \u2014 no token, no browser, no tab \u2014 could get a string of its choosing compiled as AppleScript when the deck raised a desktop notification with no page open. On macOS that is code running as you.\n\nThe strings were already passed as arguments rather than pasted into the script, which is normally the whole defence. It is not enough for `osascript`: its option parser reads any argument starting with a dash as an option, so a name beginning with `-e` was taken as more script instead of as text. Every place the deck hands `osascript` or `notify-send` something from outside now carries an explicit end-of-options marker, so nothing from outside can be read as an instruction again.\n\nNothing to change on your side beyond updating. If you would rather keep the deck off the desktop entirely, the Notifications switch in the sound menu does that, and `AGENTS_DECK_NO_NOTIFY=1` does it at launch \u2014 but the fix is the thing to have."
+    }
+  ],
+  "3.8.0": [
+    {
+      "title": "\ud83d\udd15 Notifications now have an off switch",
+      "body": "3.7.0 gave you a \"notify me\" button and no way back. Turning them off meant digging into your browser's site settings \u2014 which no page can do for you \u2014 and that still left the other notifier, the one the deck raises when no page is open at all. Silencing that one meant quitting the deck and starting it again with `AGENTS_DECK_NO_NOTIFY=1` in front. The person who wanted quiet was the one doing the work.\n\nThere is a **Notifications** switch in the sound menu now, beside the one for sound \u2014 that menu is already \"how loudly does this deck interrupt me\". One switch governs both notifiers, it takes effect immediately without a restart, and it is remembered across restarts.\n\nIt is kept by the deck rather than by your browser, because the second notifier runs when no page exists and a setting living in a page could never reach it. `AGENTS_DECK_NO_NOTIFY=1` still wins over the switch \u2014 a machine told at launch to stay off the desktop stays off it \u2014 and when that is the case the menu says so instead of showing an \"on\" that will not happen."
+    }
+  ],
   "3.7.1": [
     {
       "title": "\ud83d\udd14 The notifications now fire on the thing that actually stops your agent",

package/src/server/block-notify.mjs CHANGED Viewed

@@ -133,11 +133,19 @@ export function shouldNotify(raw, { clients, replay, lastAt, now }) {
  * to the OS.
  *
  * `notify` and `now` are injected so the suite drives this without a desktop
- * and without a clock, and `enabled` is read once at construction rather than
- * per event — a switch that can change under a running process is a switch two
- * events in the same second can disagree about.
+ * and without a clock.
+ *
+ * `enabled` USED TO BE READ ONCE at construction, on the argument that a switch
+ * changing under a running process is one two events in the same second can
+ * disagree about. That was right while the only way to set it was an
+ * environment variable, which cannot change under a running process at all. It
+ * is a user-facing switch now — deck-prefs.mjs, flipped from the sound menu —
+ * and a mute that only takes effect after a restart is not a mute. So it may be
+ * a function, asked per event; two events in the same second disagreeing is the
+ * correct behaviour when somebody pressed the switch between them.
  */
 export function createBlockNotifier({ notify, product, now = Date.now, enabled = true, onError }) {
+  const isEnabled = typeof enabled === "function" ? enabled : () => enabled;
   /** session_id → when it was last announced. Bounded by pruning on read: a
    *  long-lived server sees many sessions and this must not become a second
    *  ring nobody empties. */
@@ -146,7 +154,7 @@ export function createBlockNotifier({ notify, product, now = Date.now, enabled =
   return {
     /** Returns what it did, for the tests and for nothing else. */
     consider(raw, { clients, replay = false }) {
-      if (!enabled) return "off";
+      if (!isEnabled()) return "off";
       const at = now();
       const id = raw?.session_id ?? "";
       if (!shouldNotify(raw, { clients, replay, lastAt: seen.get(id), now: at })) return "skipped";

package/src/server/browser-react.mjs CHANGED Viewed

@@ -102,10 +102,26 @@ export async function notify(title, body, platform = process.platform, deps = {}
     // shell tool this descends from built its notification by interpolation and
     // that is the one place it had left the pattern it had banned everywhere
     // else.
+    //
+    // AND `--` BEFORE THE OPERANDS, WHICH IS THE HALF THAT WAS MISSING. Passing
+    // a string as argv is not the same as it being treated as data: osascript's
+    // option parser reads any LEADING-DASH operand as an option, so a title
+    // beginning with `-e` was taken as a second script chunk and COMPILED. The
+    // note above asserted the argv form made an attacker-chosen host name safe;
+    // it did not.
+    //
+    // The reach was the whole of it. `title` is `basename(cwd) — ccdeck` from
+    // block-notify.mjs, `cwd` arrives in the body of `POST /api/event`, and
+    // that route is in OPEN_MUTATIONS — no token, no browser identity, which is
+    // exactly the sandboxed-subprocess-with-loopback-egress case the gate
+    // comments name. Verified on Darwin 25.5 with no payload at all: without
+    // `--`, a leading `-e` operand answers "The run handler is specified more
+    // than once", which is the compiler reporting on the attacker's string;
+    // with `--`, the same string arrives as `item 1 of argv`.
     const r = await exec("osascript", [
       "-e",
       'on run argv\ndisplay notification (item 2 of argv) with title (item 1 of argv)\nend run',
-      title, body,
+      "--", title, body,
     ]).catch(() => null);
     return r?.ok === true;
   }
@@ -158,7 +174,14 @@ export async function notify(title, body, platform = process.platform, deps = {}
     ], { env: { ...process.env, CCDECK_TOAST_TITLE: title, CCDECK_TOAST_BODY: body } }).catch(() => null);
     return r?.ok === true;
   }
-  const r = await exec("notify-send", [title, body]).catch(() => null);
+  // `--` for the same reason as the darwin branch above, and it is worth having
+  // even though the consequence here is smaller: notify-send parses a leading
+  // dash as an option too, so an attacker-chosen title could suppress or
+  // misdirect the notification. There is no script compiler behind it, so this
+  // is a broken notification rather than an execution — fixed anyway, because
+  // the rule is "never let a user string be read as an option" and a rule with
+  // an exception is a rule somebody will apply to the wrong call next time.
+  const r = await exec("notify-send", ["--", title, body]).catch(() => null);
   return r?.ok === true;
 }
@@ -172,7 +195,10 @@ export async function closeTab(browserKey, url, platform = process.platform, dep
   // and says so in its own contract, so `osascript -` would read an empty
   // script and report success having done nothing. The URL still travels as
   // argv, which is the part that matters.
-  const r = await exec("osascript", ["-e", closeTabScript(app), url]).catch(() => null);
+  // `--` here too. The url comes from a real http(s) history row so it cannot
+  // begin with a dash today, but that is a property of the caller rather than
+  // of this line, and the next caller will not know it.
+  const r = await exec("osascript", ["-e", closeTabScript(app), "--", url]).catch(() => null);
   if (!r?.ok) return { ok: false, reason: "script_failed" };
   const said = String(r.stdout ?? "").trim();
   return { ok: said === "closed", reason: said || "unknown" };
@@ -185,7 +211,10 @@ export async function quitBrowser(browserKey, platform = process.platform, deps
   const exec = deps.run ?? run;
   if (platform === "darwin") {
     const r = await exec("osascript", [
-      "-e", 'on run argv\ntell application (item 1 of argv) to quit\nend run', app,
+      // `--`, as everywhere else that hands osascript an operand. `app` comes
+      // from a fixed table so it is safe by construction; the separator costs
+      // nothing and means no reader has to go and check that.
+      "-e", 'on run argv\ntell application (item 1 of argv) to quit\nend run', "--", app,
     ]).catch(() => null);
     return { ok: r?.ok === true, reason: r?.ok ? "quit" : "script_failed" };
   }

package/src/server/deck-prefs.mjs ADDED Viewed

@@ -0,0 +1,129 @@
+// The deck's own small settings, and the first of them: whether it may reach
+// the desktop.
+//
+// WHY THIS FILE EXISTS. Everything the deck could be told before this was told
+// through an environment variable read once at boot — AGENTS_DECK_NO_NOTIFY,
+// AGENTS_DECK_NO_INSTALL, AGENTS_DECK_NO_DOWNLOAD. That is the right shape for
+// "never do this on this machine", set by whoever launches the deck, and the
+// wrong shape for a switch a person wants to flip because the notifications are
+// annoying them right now: it means quitting the deck and re-running it with a
+// variable in front, which is a lot to ask of somebody whose complaint is that
+// the deck is being noisy.
+//
+// So there is one preference file, and the notification switch lives in it. The
+// env var is NOT retired and is not a default either — it is an override that
+// wins, because a machine told at launch to stay off the desktop must stay off
+// it whatever a page later posts. See `notificationsOn`.
+//
+// WHY NOT IN THE BROWSER. The desktop notifier runs in the SERVER, on the case
+// where no page exists at all — so a preference kept in localStorage could not
+// reach the code it governs at the moment that code runs. It also has to be one
+// answer per machine rather than one per browser profile: two browsers open on
+// the same deck are one deck, and a switch that meant something different in
+// each would be a switch nobody could reason about.
+//
+// The write is the atomic one browser-watch-store.mjs argues for at length —
+// temp file, rename — because the alternative is a truncated JSON document as
+// the only record of what the user chose, and a corrupt file here silently
+// turns the notifications back on.
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { claudeConfigDir } from "./claude-dir.mjs";
+/** Set to "1" to keep the deck off the desktop whatever the stored preference
+ *  says. Same sheet of switches as AGENTS_DECK_NO_DOWNLOAD and
+ *  AGENTS_DECK_NO_INSTALL, and unchanged in meaning by this file. */
+export const OFF_ENV = "AGENTS_DECK_NO_NOTIFY";
+const prefsDir = (home = claudeConfigDir()) => join(home, "agent-dag");
+export const prefsPath = (home = claudeConfigDir()) => join(prefsDir(home), "prefs.json");
+/**
+ * Every preference the deck keeps, with the answer it gives when there is no
+ * file — which is the answer for every existing install, so it has to be the
+ * behaviour those installs already have.
+ *
+ * `notifications` defaults ON because that is what 3.7.0 shipped and what the
+ * release notes describe; a switch that quietly turned an existing feature off
+ * on upgrade would be a worse surprise than the noise it is meant to stop.
+ */
+export const DEFAULTS = Object.freeze({ notifications: true });
+/** Coerce whatever is on disk into a whole, known-shaped prefs object.
+ *
+ *  Unknown keys are DROPPED rather than carried: this file is written by the
+ *  deck and read by the deck, and a key from a newer build that this one does
+ *  not understand cannot be honoured — keeping it would only mean writing back
+ *  a setting nothing here can see, which reads as support and is not. */
+export function normalise(raw) {
+  const src = raw && typeof raw === "object" ? raw : {};
+  return { notifications: typeof src.notifications === "boolean" ? src.notifications : DEFAULTS.notifications };
+}
+/** What is on disk, or the defaults. A corrupt or absent file is not an error
+ *  the user can act on mid-session, so it reads as "nothing chosen yet". */
+export async function readPrefs(home = claudeConfigDir(), deps = {}) {
+  const read = deps.readFile ?? readFile;
+  try { return normalise(JSON.parse(await read(prefsPath(home), "utf8"))); }
+  catch { return { ...DEFAULTS }; }
+}
+let _chain = Promise.resolve();
+/**
+ * Change some of the preferences, keeping the rest.
+ *
+ * A PATCH rather than a whole-state write, which is the opposite of the choice
+ * browser-watch-store.mjs makes — and deliberately. That store holds a growing
+ * archive where a merge would have to decide what wins between two decks; this
+ * holds a handful of independent booleans, where "the field I did not mention
+ * keeps its value" is the only sane reading and an omitted field erasing a
+ * setting would be a bug with no upside.
+ *
+ * Serialized for the same reason the other store is: two pages toggling two
+ * different switches in the same second must not lose one of them.
+ */
+export async function writePrefs(patch, home = claudeConfigDir(), deps = {}) {
+  const job = async () => {
+    const mk = deps.mkdir ?? mkdir;
+    const write = deps.writeFile ?? writeFile;
+    const mv = deps.rename ?? rename;
+    const next = normalise({ ...(await readPrefs(home, deps)), ...patch });
+    await mk(prefsDir(home), { recursive: true });
+    const tmp = `${prefsPath(home)}.${process.pid}.tmp`;
+    await write(tmp, JSON.stringify(next, null, 2) + "\n", "utf8");
+    await mv(tmp, prefsPath(home));
+    return next;
+  };
+  const started = _chain.then(job, job);
+  _chain = started.then(() => {}, () => {});
+  return started;
+}
+/**
+ * May the deck raise a desktop notification right now?
+ *
+ * The env var wins. A machine launched with AGENTS_DECK_NO_NOTIFY=1 has been
+ * told by whoever started it to stay off the desktop, and a page posting to
+ * /api/prefs must not be able to overrule that — the person at the keyboard and
+ * the person who wrote the launch script are not always the same person, and
+ * only one of them is making a claim about the machine.
+ */
+export function notificationsOn(prefs, env = process.env) {
+  if (env[OFF_ENV] === "1") return false;
+  return normalise(prefs).notifications;
+}
+/**
+ * Did the MACHINE veto this, as opposed to the person?
+ *
+ * Reported separately because the two are different sentences and the UI has to
+ * say the right one. Deriving it from `notificationsOn` being false was the
+ * first spelling, and the browser caught it immediately: switching the setting
+ * off made the menu read "off — set at launch" on a deck launched with no
+ * variable at all, telling the user their own press had been overruled by
+ * something that had not happened.
+ */
+export function notificationsVetoed(env = process.env) {
+  return env[OFF_ENV] === "1";
+}

package/src/server/index.mjs CHANGED Viewed

@@ -15,7 +15,8 @@ import { promisify } from "node:util";
 import { claudeConfigDir } from "./claude-dir.mjs";
 import { CODEX_HOME, CODEX_SESSIONS_DIR, STOP, walkRolloutDays } from "./codex-dir.mjs";
 import { PRODUCT } from "./brand.mjs";
-import { createBlockNotifier, OFF_ENV as NO_NOTIFY_ENV } from "./block-notify.mjs";
+import { createBlockNotifier } from "./block-notify.mjs";
+import { DEFAULTS as PREF_DEFAULTS, notificationsOn, notificationsVetoed, readPrefs, writePrefs } from "./deck-prefs.mjs";
 import { notify as osNotify } from "./browser-react.mjs";
 import { invokedName, renameNotice } from "./invoked-as.mjs";
 import { appendLogLine, codexCwdInWorkspace, electWriters, foldsCase, writesCodexLog } from "./log-writer.mjs";
@@ -3131,13 +3132,66 @@ function redactDeckToken(raw) {
  * has no notification daemon" mid-session, the deck is not broken by it, and
  * every in-page surface still says everything it said before.
  */
+/**
+ * The deck's own settings, in memory, refreshed whenever they are written.
+ *
+ * Read once at boot and then kept here rather than read per event: `consider`
+ * is on the ingest path every hook event goes through, and a file read there
+ * would be a syscall per event to answer a question that changes when somebody
+ * presses a switch. The write path below updates this, so the in-memory copy
+ * and the file cannot drift within one process — and a second deck writing the
+ * file is picked up on ITS next write or this one's next boot, which is the
+ * same freshness every other cross-deck setting has.
+ */
+let _prefs = { ...PREF_DEFAULTS };
+readPrefs().then(p => { _prefs = p; }).catch(() => {});
 const blockNotifier = createBlockNotifier({
   notify: osNotify,
   product: PRODUCT,
-  enabled: process.env[NO_NOTIFY_ENV] !== "1",
+  // A function, not a boolean: this is a switch a person flips from the sound
+  // menu while the deck is running, and a mute that waited for a restart would
+  // not be a mute. The env var still wins inside `notificationsOn`.
+  enabled: () => notificationsOn(_prefs),
   onError: err => console.error(`${PRODUCT}: could not raise a desktop notification:`, err?.message ?? err),
 });
+/**
+ * GET the deck's settings, and what the machine is allowing.
+ *
+ * THREE fields, not two, and the third is the one a first attempt got wrong.
+ * `notificationsAllowed` is the effective answer, after the environment
+ * variable has had its say — but "false" there means either "the user switched
+ * it off" or "the machine forbids it", and the menu has to say a different
+ * sentence for each. Deriving the second from the first made the switch read
+ * "off — set at launch" the moment anybody turned it off on a deck launched
+ * with no variable at all, which is the deck telling the user their own press
+ * was somebody else's doing. `notificationsVetoed` answers only the machine's
+ * half.
+ */
+function prefsPayload() {
+  return {
+    ok: true,
+    prefs: _prefs,
+    notificationsAllowed: notificationsOn(_prefs),
+    notificationsVetoed: notificationsVetoed(),
+  };
+}
+function handlePrefsRead(req, res) {
+  return send(res, 200, prefsPayload());
+}
+/** POST a patch. Fields nobody sent keep their value — see writePrefs. */
+async function handlePrefsWrite(req, res) {
+  const raw = await readBody(req).catch(() => null);
+  let body = null;
+  try { body = JSON.parse(raw ?? ""); } catch { /* handled below */ }
+  if (!body || typeof body !== "object") return send(res, 400, { ok: false, reason: "bad_request" });
+  _prefs = await writePrefs(body);
+  return send(res, 200, prefsPayload());
+}
 function pushEvent(raw, source, opts = {}) {
   // First, before anything below can see it: the deck's own credential does not
   // belong in a store that is served without one. Every entry point to the
@@ -5364,6 +5418,8 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
     if (req.method === "GET"  && url.pathname === "/api/codex-usage")  return guard(handleCodexUsage(req, res), res);
     // Machine state, not session state: sampled on the server's own timer and
     // deliberately kept out of the event stream. See src/server/system-metrics.mjs.
+    if (req.method === "GET"  && url.pathname === "/api/prefs")        return handlePrefsRead(req, res);
+    if (req.method === "POST" && url.pathname === "/api/prefs")        return guard(handlePrefsWrite(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/system")       return send(res, 200, systemSnapshot());
     // On demand only — the process list costs a subprocess on every platform,
     // so it is fetched while the detail panel is open and never on the timer.