agent-takkub 1.0.86 → 1.1.0

package/npm/scripts/lib.js

@@ -55,29 +55,32 @@ function findWheelForVersion(distDir, version) {
 // leave the file locked/hard to overwrite during recovery.
 const MIN_PYTHON_EXE_BYTES = 40 * 1024; // a real venv python.exe/python is comfortably >90KB
 
+// Opens the path exactly once and stats/reads that same descriptor for the
+// rest of the check — never stat a path and then separately open it, which
+// leaves a window for the file at that name to change between the two
+// syscalls (CodeQL js/file-system-race, alert #29).
 function pythonLooksExecutable(py) {
-  let stat;
+  let fd;
   try {
-    stat = fs.statSync(py);
+    fd = fs.openSync(py, 'r');
   } catch (_e) {
     return false;
   }
-  if (!stat.isFile() || stat.size < MIN_PYTHON_EXE_BYTES) return false;
-  if (process.platform === 'win32') {
-    // Windows PE executables always start with the 'MZ' DOS-header magic.
-    let fd;
-    try {
-      fd = fs.openSync(py, 'r');
+  try {
+    const stat = fs.fstatSync(fd);
+    if (!stat.isFile() || stat.size < MIN_PYTHON_EXE_BYTES) return false;
+    if (process.platform === 'win32') {
+      // Windows PE executables always start with the 'MZ' DOS-header magic.
       const buf = Buffer.alloc(2);
       fs.readSync(fd, buf, 0, 2, 0);
       return buf[0] === 0x4d && buf[1] === 0x5a; // 'M', 'Z'
-    } catch (_e) {
-      return false;
-    } finally {
-      if (fd !== undefined) fs.closeSync(fd);
     }
+    return true;
+  } catch (_e) {
+    return false;
+  } finally {
+    fs.closeSync(fd);
   }
-  return true;
 }
 
 function brokenInterpreterMessage(py, home) {

package/package.json

@@ -1,50 +1,50 @@
-{
-  "name": "agent-takkub",
-  "version": "1.0.86",
-  "description": "Desktop cockpit for orchestrating a team of Claude Code agents (Windows + macOS). Install globally: npm i -g agent-takkub",
-  "keywords": [
-    "claude",
-    "claude-code",
-    "ai-agents",
-    "agent-orchestration",
-    "cockpit",
-    "desktop",
-    "cli",
-    "developer-tools"
-  ],
-  "author": "takkub",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/takkub/agent-takkub.git"
-  },
-  "homepage": "https://github.com/takkub/agent-takkub#readme",
-  "bugs": {
-    "url": "https://github.com/takkub/agent-takkub/issues"
-  },
-  "bin": {
-    "agent-takkub": "npm/bin/agent-takkub.js",
-    "takkub": "npm/bin/takkub.js"
-  },
-  "scripts": {
-    "postinstall": "node npm/scripts/postinstall.js",
-    "prepublishOnly": "node npm/scripts/preflight-publish.js",
-    "test": "node --test npm/scripts/*.test.js"
-  },
-  "files": [
-    "npm/",
-    "!npm/scripts/*.test.js",
-    "dist/*.whl",
-    "assets/icon.ico",
-    "assets/icon.png",
-    "assets/cockpit-main.png"
-  ],
-  "os": [
-    "win32",
-    "darwin"
-  ],
-  "engines": {
-    "node": ">=18"
-  },
-  "engines-note": "This floor is for agent-takkub itself. The OPTIONAL graft code-intelligence feature (installed separately via `takkub doctor --fix`, not an npm dependency of this package) needs Node >=20 — see README's Requirements section. Not raised here because it would force the >=20 floor onto every user even though graft stays off until explicitly enabled.",
-  "license": "MIT"
-}
+{
+  "name": "agent-takkub",
+  "version": "1.1.0",
+  "description": "Desktop cockpit for orchestrating a team of Claude Code agents (Windows + macOS). Install globally: npm i -g agent-takkub",
+  "keywords": [
+    "claude",
+    "claude-code",
+    "ai-agents",
+    "agent-orchestration",
+    "cockpit",
+    "desktop",
+    "cli",
+    "developer-tools"
+  ],
+  "author": "takkub",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/takkub/agent-takkub.git"
+  },
+  "homepage": "https://github.com/takkub/agent-takkub#readme",
+  "bugs": {
+    "url": "https://github.com/takkub/agent-takkub/issues"
+  },
+  "bin": {
+    "agent-takkub": "npm/bin/agent-takkub.js",
+    "takkub": "npm/bin/takkub.js"
+  },
+  "scripts": {
+    "postinstall": "node npm/scripts/postinstall.js",
+    "prepublishOnly": "node npm/scripts/preflight-publish.js",
+    "test": "node --test npm/scripts/*.test.js"
+  },
+  "files": [
+    "npm/",
+    "!npm/scripts/*.test.js",
+    "dist/*.whl",
+    "assets/icon.ico",
+    "assets/icon.png",
+    "assets/cockpit-main.png"
+  ],
+  "os": [
+    "win32",
+    "darwin"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "engines-note": "This floor is for agent-takkub itself. The OPTIONAL graft code-intelligence feature (installed separately via `takkub doctor --fix`, not an npm dependency of this package) needs Node >=20 — see README's Requirements section. Not raised here because it would force the >=20 floor onto every user even though graft stays off until explicitly enabled.",
+  "license": "MIT"
+}