npm - agent-dag - Versions diffs - 3.8.2 → 3.8.4 - Mend

agent-dag 3.8.2 → 3.8.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/dist/web/assets/{index-D4ZAGkpT.js → index-DkJt3T9U.js} +6 -2
package/dist/web/index.html +1 -1
package/package.json +1 -1
package/release-notes.json +12 -0
package/src/server/browser-watch-store.mjs +10 -2
package/src/server/deck-prefs.mjs +11 -2
package/src/server/installer.mjs +61 -5

package/dist/web/index.html CHANGED Viewed

@@ -40,7 +40,7 @@
         document.documentElement.setAttribute("data-theme", stored === "light" ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-D4ZAGkpT.js"></script>
+    <script type="module" crossorigin src="/assets/index-DkJt3T9U.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-ByAgTqB8.css">
   </head>
   <body>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "3.8.2",
+  "version": "3.8.4",
   "description": "Live deck of Claude Code and Codex agents — watch tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json CHANGED Viewed

@@ -31,6 +31,18 @@
     "about a defect in the type, and the suite refuses both it and no space at",
     "all."
   ],
+  "3.8.4": [
+    {
+      "title": "\ud83e\uddf7 Your own hooks can no longer be eaten by two decks starting together",
+      "body": "If you keep hooks of your own in `settings.json`, the deck parks them while it installs and puts them back afterwards. Two decks starting at the same moment could interleave inside that, and the loser wrote a version of the file computed before the restore \u2014 so your hook was gone from `settings.json` and gone from the park, which was its only other copy.\n\nThere was already a check for this, and it had a hole: if the last-moment re-read of the file failed, it read that as \"nothing changed\" and wrote anyway. A failed read is the one moment that check was most needed, because the usual reason a file cannot be read for a few milliseconds is that something else has just written it.\n\n`ccdeck --uninstall` had no such check at all and could overwrite a deck that was starting, then exit 0 saying it had succeeded. It has one now, and when it declines it says so and tells you to run it again rather than reporting that there was nothing to remove."
+    }
+  ],
+  "3.8.3": [
+    {
+      "title": "\ud83e\ude9f Windows: two settings files that could refuse to save",
+      "body": "On Windows a file cannot be moved into place while anything else has it open, and Defender and the search indexer open a file the instant it is written. The deck has had a retry for that for a long time, and two files written in the last few days were not using it: the notifications preference, and Browser Watch's episode archive.\n\nWhen it bit, the notifications switch silently did not stick, and Browser Watch answered an error and showed an empty panel. Both now retry the way everything else in the deck already did.\n\nNothing changes on macOS or Linux, where the operating system never refused the move in the first place \u2014 which is why this got past a green test suite on both."
+    }
+  ],
   "3.8.2": [
     {
       "title": "\u2328\ufe0f A closed-behind-your-back dialog no longer kills every keyboard shortcut",

package/src/server/browser-watch-store.mjs CHANGED Viewed

@@ -17,7 +17,10 @@
 // `~/.claude/agent-dag`: readLiveDecks() reads every `.json` in that directory
 // and would have to keep skipping this one forever. A subdirectory is not a
 // name it can collide with.
-import { appendFile, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
+// The rename, with the Windows retry ladder installer.mjs wrote for exactly
+// this call. See the note over `writeNow` (#786).
+import { renameWithRetry } from "./installer.mjs";
 import { join } from "node:path";
 import { claudeConfigDir } from "./claude-dir.mjs";
@@ -258,7 +261,12 @@ export async function writeStore(state, home = claudeConfigDir(), deps = {}) {
 async function writeNow(state, home, deps) {
   const mk = deps.mkdir ?? mkdir;
   const write = deps.writeFile ?? writeFile;
-  const mv = deps.rename ?? rename;
+  // `renameWithRetry`, not `rename` (#786). Same Windows rule as deck-prefs,
+  // and the stakes are higher here: none of the three writers catches the
+  // throw, so a refused rename 500s `GET /api/browser-watch` and the panel goes
+  // blank, while the episode archive — the file that exists BECAUSE an intruder
+  // can clear the browser's own history — is not written at all.
+  const mv = deps.rename ?? renameWithRetry;
   await mk(storeDir(home), { recursive: true });
   const body = JSON.stringify({
     v: STORE_VERSION,

package/src/server/deck-prefs.mjs CHANGED Viewed

@@ -26,7 +26,10 @@
 // temp file, rename — because the alternative is a truncated JSON document as
 // the only record of what the user chose, and a corrupt file here silently
 // turns the notifications back on.
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+// The rename, with the Windows retry ladder installer.mjs wrote for exactly
+// this call. See the note over the write below (#786).
+import { renameWithRetry } from "./installer.mjs";
 import { join } from "node:path";
 import { claudeConfigDir } from "./claude-dir.mjs";
@@ -87,7 +90,13 @@ export async function writePrefs(patch, home = claudeConfigDir(), deps = {}) {
   const job = async () => {
     const mk = deps.mkdir ?? mkdir;
     const write = deps.writeFile ?? writeFile;
-    const mv = deps.rename ?? rename;
+    // `renameWithRetry`, not `rename` (#786). MoveFileExW refuses while any
+    // handle without FILE_SHARE_DELETE is open on either side, and Defender and
+    // the search indexer open a file the instant it is written — so on Windows
+    // a bare rename fails on a perfectly healthy machine, `POST /api/prefs`
+    // 500s through `guard`, and the notifications switch silently does not
+    // stick. POSIX rename(2) has no such rule, which is why this shipped green.
+    const mv = deps.rename ?? renameWithRetry;
     const next = normalise({ ...(await readPrefs(home, deps)), ...patch });
     await mk(prefsDir(home), { recursive: true });
     const tmp = `${prefsPath(home)}.${process.pid}.tmp`;

package/src/server/installer.mjs CHANGED Viewed

@@ -528,8 +528,27 @@ export async function installHooks({ provider = "claude", beforeWrite = null } =
     // real fs work, so a test that raced it by wall clock would pass or fail by
     // how fast the machine is. Production passes nothing.
     if (beforeWrite) await beforeWrite();
-    const { raw: onDisk } = await readSettingsForWrite(cfg.settingsPath).catch(() => ({ raw: before }));
-    if (onDisk !== before) {
+    // A READ THE GUARD COULD NOT PERFORM IS NOT PROOF NOTHING CHANGED (#788).
+    // This used to be `.catch(() => ({ raw: before }))`, which substituted the
+    // snapshot and so answered "unchanged" for every failed re-read. ENOENT is
+    // the one case that substitution would be right for, and it does not reach
+    // here at all — readSettingsForWrite returns `{ raw: null }` for it without
+    // throwing. What does reach here is EACCES/EBUSY on a file written
+    // microseconds ago, which is the condition this module's own header names:
+    // "a virus scanner or the search indexer opens files the instant they are
+    // written, so the target is briefly untouchable on a perfectly healthy
+    // machine". Precisely when another deck has just written it.
+    //
+    // So an unreadable re-read declines, like a changed one. Declining is safe
+    // for the reason above: every boot reinstalls and the next pass converges.
+    // Being wrong the other way is not — it is the lost update this guard
+    // exists to prevent, with the user's own sound hook gone from settings.json
+    // and from the park that was its only other copy.
+    let onDisk;
+    let unreadable = false;
+    try { ({ raw: onDisk } = await readSettingsForWrite(cfg.settingsPath)); }
+    catch { unreadable = true; }
+    if (unreadable || onDisk !== before) {
       return {
         settingsPath: cfg.settingsPath, hookPath, events: cfg.events, provider,
         changed: false, raced: true, retire: { ...retire, pending: false },
@@ -572,12 +591,13 @@ export async function installHooks({ provider = "claude", beforeWrite = null } =
  * quietly do nothing. Only ENOENT is genuinely empty, and readSettingsForWrite
  * already answers that with `{}`, which falls through to `changed: false`.
  */
-export async function uninstallHooks({ provider = "claude" } = {}) {
+export async function uninstallHooks({ provider = "claude", beforeWrite = null } = {}) {
   const cfg = PROVIDERS[provider];
   if (!cfg) throw new Error(`unknown provider: ${provider}`);
   let current;
+  let before;
   try {
-    ({ settings: current } = await readSettingsForWrite(cfg.settingsPath));
+    ({ settings: current, raw: before } = await readSettingsForWrite(cfg.settingsPath));
   } catch (err) {
     if (err?.code !== "SETTINGS_UNREADABLE") throw err;
     // Same shape retireSoundHook answers with, so bin/deck.js reports both
@@ -601,7 +621,43 @@ export async function uninstallHooks({ provider = "claude" } = {}) {
     if (cleaned.length === 0) delete current.hooks[evt];
     else current.hooks[evt] = cleaned;
   }
-  if (changed) await writeFileAtomic(cfg.settingsPath, JSON.stringify(current, null, 2) + "\n");
+  if (changed) {
+    // THE SAME GUARD ITS SIBLING HAS, for the same file (#788). `installHooks`
+    // grew a compare-against-the-file check at the last moment and this
+    // function — which rewrites the same settings.json from a snapshot read
+    // just as long ago — never got one.
+    //
+    // The race is `ccdeck --uninstall` against a deck that is starting.
+    // Uninstall reads settings.json with the user's own hooks still parked. In
+    // the window before its write — resolveWriteTarget, temp create, write,
+    // fsync, stat, rename — the booting deck restores those hooks and deletes
+    // the park. Uninstall then writes its stale object over the restore,
+    // bin/deck.js re-reads the clobbered file, readParked hits ENOENT, and it
+    // reports `restored: 0`. The hooks are gone from both copies and the CLI
+    // exits 0 saying the uninstall succeeded.
+    //
+    // Declining here is not as cheap as declining an install — nothing retries
+    // an uninstall — so it says so in the result rather than answering `ok`
+    // with `changed: false`, which would read as "there was nothing to remove".
+    // The seam the suite needs, and `installHooks` states the argument for it:
+    // the window this guard covers is filled with real fs work, so a test that
+    // raced it by wall clock would pass or fail by how fast the machine is.
+    // Production passes nothing.
+    if (beforeWrite) await beforeWrite();
+    let onDisk;
+    let unreadable = false;
+    try { ({ raw: onDisk } = await readSettingsForWrite(cfg.settingsPath)); }
+    catch { unreadable = true; }
+    if (unreadable || onDisk !== before) {
+      return {
+        ok: false, reason: "raced", changed: false, provider,
+        settingsPath: cfg.settingsPath,
+        why: "another writer changed settings.json while the uninstall was running",
+        message: `${cfg.settingsPath} changed while uninstalling — nothing was removed. Run --uninstall again.`,
+      };
+    }
+    await writeFileAtomic(cfg.settingsPath, JSON.stringify(current, null, 2) + "\n");
+  }
   return { ok: true, changed, provider, settingsPath: cfg.settingsPath };
 }