npm - agent-dag - Versions diffs - 3.8.7 → 3.8.9 - Mend

agent-dag 3.8.7 → 3.8.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (16) hide show

package/bin/agent-dag.js +2 -2
package/bin/deck.js +13 -4
package/dist/web/assets/{index-GmdcK9zD.js → index-Dq0gpZ5v.js} +8 -2
package/dist/web/index.html +1 -1
package/package.json +1 -1
package/release-notes.json +12 -0
package/src/server/browser-presence.mjs +9 -0
package/src/server/browser-react.mjs +8 -2
package/src/server/ccusage.mjs +20 -2
package/src/server/claude-accounts.mjs +17 -1
package/src/server/cswap-auto.mjs +30 -5
package/src/server/index.mjs +47 -11
package/src/server/self-update.mjs +36 -2
package/src/server/supervisor.mjs +3 -3
package/src/server/system-metrics.mjs +42 -10
package/src/server/term.mjs +9 -2

package/dist/web/index.html CHANGED Viewed

@@ -40,7 +40,7 @@
         document.documentElement.setAttribute("data-theme", stored === "light" ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-GmdcK9zD.js"></script>
+    <script type="module" crossorigin src="/assets/index-Dq0gpZ5v.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-ByAgTqB8.css">
   </head>
   <body>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "3.8.7",
+  "version": "3.8.9",
   "description": "Live deck of Claude Code and Codex agents — watch tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json CHANGED Viewed

@@ -31,6 +31,18 @@
     "about a defect in the type, and the suite refuses both it and no space at",
     "all."
   ],
+  "3.8.9": [
+    {
+      "title": "\ud83d\udda5\ufe0f Four things that only went wrong on somebody else's operating system",
+      "body": "**Ubuntu:** the deck knew where Chromium and Brave keep their profiles when installed as a snap or a flatpak \u2014 which on a default Ubuntu is the only place Chromium is \u2014 but not what those programs are called. So it reported them as not running while they were, and refused to quit them. Both now work.\n\n**Windows:** the deck asked the system whether it could write to the folder an update installs into, and Windows always answers yes for a folder whatever the permissions say. It offered you an update that then died inside npm with a permission error. It now finds out by trying, and declines up front with the command to run yourself \u2014 which is what every other platform already got.\n\n**Linux:** if `XDG_DATA_HOME` was set to something starting with `~`, as it is from a systemd unit or a Dockerfile, the deck and claude-swap looked in two different places for your accounts. The panel said you had none while `cswap list` showed them all.\n\n**Plain terminals:** six messages used a typographic dash the old Windows console and the Linux text console cannot draw, so a box appeared mid-sentence \u2014 including in the line that explains why no events are arriving. They use the plain form on those terminals now, like everything else already did."
+    }
+  ],
+  "3.8.8": [
+    {
+      "title": "\ud83d\udcc9 A false 99% on the memory chart, and three other quiet failures",
+      "body": "**The machine meter no longer invents a reading.** When the deck could not measure memory \u2014 a subprocess that would not start under load, or one that took too long \u2014 it substituted a number that means something else, and on a Mac that reads as about 99% used. The meter went red for half a minute, and because the chart keeps the highest value in each minute, that false peak stayed on it for a full day. A poll that cannot measure now keeps the last reading and records nothing: a gap in the chart is honest.\n\n**A failed ccusage repair no longer disables the repair.** If the deck found a half-installed copy it removes it and starts again. On Windows that removal can fail for a few seconds because the program it just ran still has the folder open \u2014 and the deck then treated the attempt as spent and never tried again for the rest of the session, leaving the panel permanently unable to read your usage. It now only counts a repair that happened.\n\n**Changing the auto-switch interval takes effect even during startup.** Set it in the first seconds after launch and the timer kept the old value for the life of the process, while the panel showed the new one.\n\n**Codex sessions with very large histories no longer cost hundreds of megabytes to read.** The deck read the whole file to find four values that live at its two ends \u2014 measured at 185 MB of memory and 95ms of frozen interface for one 44 MB session. It now reads only the ends."
+    }
+  ],
   "3.8.7": [
     {
       "title": "\ud83e\udde0 Four things in the panel that behaved wrongly",

package/src/server/browser-presence.mjs CHANGED Viewed

@@ -76,6 +76,15 @@ const APP_NAME = {
     "chrome-beta": "chrome",
     "chrome-canary": "chrome",
     chromium: "chromium",
+    // The two roots `browserRoots` emits and this table used to miss (#794).
+    // The snap path's own comment there says it "is the only Chromium root a
+    // default Ubuntu install has" — so on stock Ubuntu the panel reported
+    // Chromium as not running while it was running, and the quit reaction,
+    // which `available("linux")` does offer, answered `unknown_browser` on
+    // every finding from either of them. darwin covers all 8 of its roots and
+    // win32 all 7 of its own; only this table was short.
+    "chromium-snap": "chromium",
+    "brave-flatpak": "brave",
     brave: "brave",
     edge: "msedge",
     vivaldi: "vivaldi-bin",

package/src/server/browser-react.mjs CHANGED Viewed

@@ -206,10 +206,16 @@ export async function closeTab(browserKey, url, platform = process.platform, dep
 /** Quit a browser. The only reaction that takes the session back. */
 export async function quitBrowser(browserKey, platform = process.platform, deps = {}) {
-  const app = appName(browserKey);
-  if (!app) return { ok: false, reason: "unknown_browser" };
   const exec = deps.run ?? run;
   if (platform === "darwin") {
+    // The darwin display-name table is consulted HERE rather than at the top of
+    // the function (#794). It used to gate every platform, so a browser missing
+    // from a macOS-only table — `chromium-snap` and `brave-flatpak`, the two
+    // roots a default Ubuntu install actually has — answered `unknown_browser`
+    // on Linux before the branch that would have known what to do with it was
+    // ever reached.
+    const app = appName(browserKey);
+    if (!app) return { ok: false, reason: "unknown_browser" };
     const r = await exec("osascript", [
       // `--`, as everywhere else that hands osascript an operand. `app` comes
       // from a fixed table so it is safe by construction; the separator costs

package/src/server/ccusage.mjs CHANGED Viewed

@@ -682,7 +682,19 @@ let _repairedThisRun = false;
 function discardDamagedInstall(runner, err) {
   if (_repairedThisRun || runner.kind !== "node" || installsDisabled()) return false;
   if (!cannotLoadModule(err?.message)) return false;
-  _repairedThisRun = true;
+  // THE FLAG IS SPENT ON A REPAIR THAT HAPPENED, not on one that was attempted
+  // (#790). It used to be set here, before the try — and the rm below fails on
+  // Windows for the reason its own maxRetries comment gives: the `node <entry>`
+  // child that just exited still holds a handle, the unlink marks the file
+  // delete-pending, and rmdir answers ENOTEMPTY past all ten retries. The catch
+  // returned false with NOTHING removed, and every later modal open and every
+  // 60s poll for the life of the deck then short-circuited on this same flag —
+  // including seconds later, once the handle was gone and the rm would have
+  // worked. The user's only way out was deleting ~/.agents-deck/ccusage by
+  // hand, which nothing tells them.
+  //
+  // The budget exists to stop a loop of INSTALLS. Here it was being consumed by
+  // a repair that never happened and never reached an install.
   try {
     // maxRetries because of what has just happened: the deck ran `node <entry>`
     // out of this very directory a moment ago, and on Windows a file any handle
@@ -700,7 +712,13 @@ function discardDamagedInstall(runner, err) {
     // rather than retrying into the same broken entry point.
     return false;
   }
-  return !resolveEntry();
+  const gone = !resolveEntry();
+  // Only now. The directory is really gone, so this deck has spent its one
+  // repair and the budget is doing its job. A failed `rm` returned false above
+  // without touching the flag, so the next poll — seconds later, once the
+  // handle is released — is free to try again.
+  if (gone) _repairedThisRun = true;
+  return gone;
 }
 /**

package/src/server/claude-accounts.mjs CHANGED Viewed

@@ -39,7 +39,23 @@ import { homedir, platform } from "node:os";
 export function backupRoot() {
   if (process.env.CLAUDE_SWAP_BACKUP) return process.env.CLAUDE_SWAP_BACKUP;
   if (platform() === "linux") {
-    const xdg = process.env.XDG_DATA_HOME;
+    // `~` IS EXPANDED BEFORE THE ABSOLUTENESS TEST (#796), which is what
+    // claude-swap's own paths.py does: `Path(os.path.expanduser(xdg))` and then
+    // `is_absolute()`, under a docstring saying it exists so that "values like
+    // `~/data` set via systemd unit files or Dockerfiles (which don't get shell
+    // expansion) still work". This function claims to mirror that and did not.
+    //
+    // Unexpanded, `XDG_DATA_HOME=~/data` failed `startsWith("/")` and the deck
+    // read ~/.local/share/claude-swap while cswap read and wrote
+    // ~/data/claude-swap. The Accounts panel then reported `no_accounts` while
+    // `cswap list` showed the roster — and the damaging part is
+    // `seedFirstAccount`, which reads a missing sequence file as zero accounts,
+    // passes its `before > 0` guard, and runs `cswap add` against a populated
+    // store, re-pointing activeAccountNumber with nothing here to restore it.
+    const raw = process.env.XDG_DATA_HOME;
+    const xdg = raw === "~" ? homedir()
+      : raw?.startsWith("~/") ? join(homedir(), raw.slice(2))
+      : raw;
     if (xdg && xdg.startsWith("/")) return join(xdg, "claude-swap");
     return join(homedir(), ".local/share/claude-swap");
   }

package/src/server/cswap-auto.mjs CHANGED Viewed

@@ -268,6 +268,8 @@ export async function setCswapConfig(key, value) {
   // Lowering it was equally inert.
   if (r.ok && key === "autoswitch.intervalSeconds" && _enabled) {
     stopLoop();
+    // startLoop records the ask when one is already in flight, so this can no
+    // longer be swallowed by the boot's own start — see the note there (#791).
     await startLoop();
   }
   return r.ok ? { ok: true } : { ok: false, reason: "set_failed", detail: (r.stderr || r.stdout).trim().slice(0, 300) };
@@ -580,19 +582,42 @@ function tick() {
  * has turned it off is the same defect from the other side.
  */
 async function startLoop() {
-  if (_timer || _starting) return;
+  // A start requested while one is already in flight is REMEMBERED, not dropped
+  // (#791). `initCswapAuto()` is fired unawaited at boot, so this sits inside
+  // `await tickInterval()` — a `cswap config` spawn, preceded on Windows by
+  // cswapBin() probing up to four spellings, two of them through cmd.exe, each
+  // with an 8s deadline — while the panel is already serving. A user setting
+  // the interval in that window called stopLoop() (no timer yet: a no-op) and
+  // then startLoop(), which returned here having done nothing; the boot's own
+  // start then resumed with the interval it had read BEFORE the write and
+  // installed the timer at the old value. The panel read back the new number
+  // while the loop kept the old one for the life of the process.
+  if (_starting) { _restartWanted = true; return; }
+  if (_timer) return;
   _starting = true;
   try {
-    const ms = await tickInterval();
-    if (!_enabled) return;   // turned off while we were asking cswap
-    _timer = setInterval(() => { tick().catch(() => {}); }, ms);
-    _timer.unref?.();
+    // Loop rather than a single pass: the config may be written again while
+    // THIS read is in flight, and the answer must be the last one written.
+    for (;;) {
+      _restartWanted = false;
+      const ms = await tickInterval();
+      if (!_enabled) return;   // turned off while we were asking cswap
+      if (_restartWanted) continue;   // the interval changed under this read
+      _timer = setInterval(() => { tick().catch(() => {}); }, ms);
+      _timer.unref?.();
+      break;
+    }
   } finally {
     _starting = false;
   }
   tick().catch(() => {});   // don't make the user wait a full interval for the first one
 }
+/** Set when a restart is asked for while `startLoop` is mid-read, so the read
+ *  that is already running takes the new value instead of installing the old
+ *  one. Module-level beside `_starting`, which it exists to answer for. */
+let _restartWanted = false;
 function stopLoop() {
   if (_timer) { clearInterval(_timer); _timer = null; }
 }

package/src/server/index.mjs CHANGED Viewed

@@ -1851,21 +1851,57 @@ async function findCodexRolloutPath(sid) {
   return found;
 }
-/** Tail-read a Codex rollout JSONL. Returns the last token_count info block
- *  plus the most recent observed model + the session's model_context_window
- *  (set once from task_started). */
-async function readCodexRollout(path) {
+/**
+ * The head and the tail of a Codex rollout, never the middle.
+ *
+ * WHAT THIS FIXES (#792). It called itself a tail-read and read the whole file:
+ * `Buffer.alloc(s.size)` in one go, then `split` and `JSON.parse` over every
+ * line. Measured against this machine's own largest rollout — 44.4 MB — that is
+ * 181ms to read and decode, 95ms of SYNCHRONOUS parsing blocking the event
+ * loop, and 185 MB of resident memory for the buffer, the string and the split
+ * array together. Past about 512 MB `toString` throws outright, the catch
+ * answers null, and the deck reports no Codex usage or model for the rest of
+ * its life.
+ *
+ * It is reached from `/api/event`, which is in OPEN_MUTATIONS — no token, no
+ * browser identity — so any local process can ask for it, and the per-session
+ * throttle is keyed on `sid`, which means distinct sid strings each get their
+ * own budget. That note's own rule is the one this violated: the deck's memory
+ * "cannot be a function of anything but the two constants named here".
+ *
+ * WHY HEAD AND TAIL RATHER THAN A CURSOR. The four fields do not live in one
+ * place. `session_meta` is the FIRST record — cwd, sometimes the model — while
+ * the last `token_count`, the last `task_started` and the newest
+ * `response_item` model are all at the END. A forward cursor would have to keep
+ * the head's answers across polls, which is a second cache to invalidate; two
+ * bounded reads answer the same question with no state at all.
+ *
+ * A file smaller than both windows is read once, so nothing changes for the
+ * ordinary rollout — the median here is well under a megabyte.
+ */
+const CODEX_HEAD_BYTES = 256 * 1024;
+const CODEX_TAIL_BYTES = 2 * 1024 * 1024;
+// Exported for the suite, which is the only way to drive the head-and-tail
+// branch: building a rollout larger than both windows is cheap, and reaching
+// this function through /api/event would mean a server, a discovery file and a
+// throttle that all have nothing to do with what is being measured.
+export async function readCodexRollout(path) {
   try {
     const s = await stat(path);
     if (s.size === 0) return null;
-    const fh = await open(path, "r");
     let text;
-    try {
-      const buf = Buffer.alloc(s.size);
-      await fh.read(buf, 0, s.size, 0);
-      text = buf.toString("utf8");
-    } finally {
-      await fh.close();
+    if (s.size <= CODEX_HEAD_BYTES + CODEX_TAIL_BYTES) {
+      text = await readByteRange(path, 0, s.size);
+    } else {
+      // A newline between them so the two windows cannot splice a half line
+      // from the head onto a half line from the tail and hand the parser a
+      // record that never existed. The tail's own first line is partial by
+      // construction and is dropped the same way: `JSON.parse` refuses it and
+      // the loop below skips it.
+      const head = await readByteRange(path, 0, CODEX_HEAD_BYTES);
+      const tail = await readByteRange(path, s.size - CODEX_TAIL_BYTES, s.size);
+      text = `${head}\n${tail}`;
     }
     let lastUsage = null;
     let model = null;

package/src/server/self-update.mjs CHANGED Viewed

@@ -22,7 +22,7 @@
 // it by name and only where it can actually work: a global install, on a
 // directory we can write, outside a git checkout and outside an npx cache.
 // Everywhere else this stays what it has always been — a printed command.
-import { accessSync, constants as FS, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { accessSync, constants as FS, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
@@ -894,8 +894,42 @@ export function upgradeMode(blockedReason) {
   return blockedReason === "npx" ? "npx" : null;
 }
+/**
+ * Can this user write into `p`?
+ *
+ * ON WINDOWS THE QUESTION HAS TO BE ASKED BY WRITING (#795). libuv's
+ * `fs__access` short-circuits to success for anything carrying
+ * FILE_ATTRIBUTE_DIRECTORY — "Directories cannot be read-only on Windows" — and
+ * never consults the ACL; Node documents this. Both arguments this is called
+ * with are always directories, so `writable` was unconditionally true there,
+ * `upgradeBlockedReason` could never answer `not_writable`, and the banner
+ * offered "Update & restart" on the common nvm-windows layout where the global
+ * prefix is C:\Program Files\nodejs and a non-elevated shell cannot write it.
+ * npm then died with EPERM and the user got a truncated npm log tail in a
+ * 46-character box — where a POSIX user in the same position gets "the install
+ * directory is not writable by this user" and the command to paste. The comment
+ * on upgradeBlockedReason states the intent the platform defeated: "Failing
+ * inside npm with EACCES tells the user less than declining up front does."
+ *
+ * The probe is `createTemp`'s "wx" pattern, synchronously: a name nothing else
+ * can be using, created exclusively and removed at once. POSIX keeps
+ * `accessSync`, where it is correct and cheaper.
+ */
 function dirWritable(p) {
-  try { accessSync(p, FS.W_OK); return true; } catch { return false; }
+  if (process.platform !== "win32") {
+    try { accessSync(p, FS.W_OK); return true; } catch { return false; }
+  }
+  // `wx` fails if the name exists, so a collision reads as "not writable"
+  // rather than clobbering somebody's file — hence pid and a random suffix.
+  const probe = join(p, `.ccdeck-w-${process.pid}-${Math.random().toString(36).slice(2, 8)}`);
+  try {
+    writeFileSync(probe, "", { flag: "wx" });
+    return true;
+  } catch {
+    return false;
+  } finally {
+    try { unlinkSync(probe); } catch { /* never created, or already gone */ }
+  }
 }
 /** The same question, answered against the real filesystem and environment. */

package/src/server/supervisor.mjs CHANGED Viewed

@@ -225,13 +225,13 @@ export function upgradeAttempt({
  *  banner and the terminal say, so it has to name the version, say what already
  *  happened to it, and leave the user somewhere to go. The copyable command is
  *  already on screen next to it. */
-export function upgradeRefusalText({ reason, waitMs = 0, attempt = 0 } = {}, target = null) {
+export function upgradeRefusalText({ reason, waitMs = 0, attempt = 0, dash = "—" } = {}, target = null) {
   const what = target ? `v${target}` : "this update";
   if (reason === "exhausted") {
-    return `${what} failed to fetch ${attempt} times — not trying again from here; run the command yourself`;
+    return `${what} failed to fetch ${attempt} times ${dash} not trying again from here; run the command yourself`;
   }
   const left = waitMs >= 60_000 ? `${Math.ceil(waitMs / 60_000)}m` : `${Math.max(1, Math.ceil(waitMs / 1000))}s`;
-  return `${what} failed to fetch a moment ago — waiting ${left} before trying again`;
+  return `${what} failed to fetch a moment ago ${dash} waiting ${left} before trying again`;
 }
 /**

package/src/server/system-metrics.mjs CHANGED Viewed

@@ -262,6 +262,32 @@ export function availableFromVmStat(text, total) {
   return total != null && avail > total ? null : avail;
 }
+/**
+ * How much memory is really available, or NULL when this machine could not be
+ * asked.
+ *
+ * `os.freemem()` USED TO BE THE FALLBACK ON BOTH REAL PLATFORMS, and it is the
+ * one number this function exists to avoid (#789). The header above says why:
+ * counting only genuinely free pages makes the naive `(total - free) / total`
+ * read 99.5% on an idle 32 GB Mac — "a number that would send the reader
+ * straight to Activity Monitor, which is the one outcome this readout exists to
+ * prevent". So a failed measurement produced exactly the reading the module was
+ * written to suppress.
+ *
+ * And it did not merely flicker. `record` folds into the minute bucket by
+ * MAXIMUM, so one failed poll painted a red 99% peak on the memory chart that
+ * survived every good sample for the next twenty-four hours. The failure is
+ * ordinary: `run` resolves null on a spawn error (EAGAIN/EMFILE under fork
+ * pressure — a deck watching many agents is exactly that), on a non-zero exit,
+ * and on its own 2s deadline. 2,880 chances a day.
+ *
+ * Null instead, and the caller keeps the previous reading and records nothing.
+ * A gap in the chart is honest; a 99% peak is not.
+ *
+ * The last branch still answers `freemem()` because on Windows there is no
+ * better source to have failed — it is the measurement, not a substitute for
+ * one.
+ */
 async function readAvailable(platform = process.platform) {
   const total = os.totalmem();
@@ -269,14 +295,13 @@ async function readAvailable(platform = process.platform) {
     try {
       const parsed = availableFromMeminfo(await readFile("/proc/meminfo", "utf8"));
       if (parsed != null) return parsed;
-    } catch { /* fall through to freemem */ }
-    return os.freemem();
+    } catch { /* unreadable /proc — say so rather than guessing */ }
+    return null;
   }
   if (platform === "darwin") {
     const out = await run("vm_stat", []);
-    const parsed = out ? availableFromVmStat(out, total) : null;
-    return parsed ?? os.freemem();
+    return (out ? availableFromVmStat(out, total) : null) ?? null;
   }
   return os.freemem();
@@ -1382,15 +1407,22 @@ async function sampleMemory() {
   try {
     const total = os.totalmem();
     const available = await readAvailable();
-    memory = {
-      total,
-      available,
-      usedPct: Math.max(0, Math.min(100, Math.round(((total - available) / total) * 1000) / 10)),
-    };
+    // A poll that could not measure leaves the last reading standing and puts
+    // nothing in the history (#789). Recording a guess here is worse than
+    // recording nothing twice over: the meter would go red for 30 seconds, and
+    // the bucket's Math.max would keep that peak on the chart for a day.
+    // Swap below is a separate measurement and is still taken.
+    if (available != null) {
+      memory = {
+        total,
+        available,
+        usedPct: Math.max(0, Math.min(100, Math.round(((total - available) / total) * 1000) / 10)),
+      };
+      record("mem:physical", memory.usedPct);
+    }
     // Same 30s cadence as memory, and for the same reason: it moves in minutes
     // and costs a subprocess on two of the three platforms.
     swap = await readSwap();
-    record("mem:physical", memory.usedPct);
     if (swap && swap.total > 0) record("mem:swap", Math.round((swap.used / swap.total) * 1000) / 10);
   } catch { /* keep the previous reading rather than blanking the meter */ }
   finally { memInFlight = false; }

package/src/server/term.mjs CHANGED Viewed

@@ -628,12 +628,19 @@ export function pulseDot(beat, { registered = true, claude = true, busy = null }
  *
  * @param file the discovery file that could not be written.
  * @param claude whether this deck is watching Claude Code at all.
+ * @param dash the em dash, or the ASCII stand-in on a console that cannot draw
+ *   one (#797). A parameter for the same reason `renameNotice` takes one: this
+ *   module's own header says "every glyph the deck prints — punctuation
+ *   included, since an em dash is as absent from CP437 as a check mark — comes
+ *   from one of them", and this sentence had it hardcoded. On a legacy cmd.exe
+ *   or the Linux virtual console the reader got a box in the middle of the one
+ *   line explaining why no events are arriving.
  */
-export function unregisteredDetail({ file, claude = true }) {
+export function unregisteredDetail({ file, claude = true, dash = "—" }) {
   if (claude) {
     return `Claude Code hooks find this deck through ${file}, so until that file exists no Claude Code events arrive.`;
   }
-  return `Codex capture does not use ${file} — the deck tails the rollout files itself — so events still arrive. Only decks sharing one events log need it, to agree on which of them records.`;
+  return `Codex capture does not use ${file} ${dash} the deck tails the rollout files itself ${dash} so events still arrive. Only decks sharing one events log need it, to agree on which of them records.`;
 }
 // ── cursor ───────────────────────────────────────────────────────────────────