teapot-coding-agent 0.28.0 → 0.28.1

package/dist/index.js

@@ -5,8 +5,9 @@
  * Config may also come from TEAPOT_* env vars (see src/master.ts).
  * First run (no config file): boot anyway and finish setup in the web UI.
  */
-import { existsSync } from "node:fs";
+import { existsSync, realpathSync } from "node:fs";
 import { createServer } from "node:net";
+import { fileURLToPath } from "node:url";
 import { loadConfig, resolveConfigPath, Master } from "./master.js";
 import { buildApp, serveApp } from "./server/api.js";
 /**
@@ -259,10 +260,35 @@ async function main() {
 // test importing it and sat at 48% branch coverage. The check is the standard
 // ESM "am I the entry point" test, and `node --experimental-strip-types src/index.ts`
 // and `node dist/index.js` both still take this branch.
-const isEntry = process.argv[1] !== undefined &&
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    (process.argv[1] === new URL(import.meta.url).pathname ||
-        process.argv[1].endsWith("/index.js") ||
-        process.argv[1].endsWith("/index.ts"));
-if (isEntry)
+function isEntryPoint() {
+    const arg = process.argv[1];
+    if (!arg)
+        return false;
+    // `npm i -g teapot-coding-agent` puts a SYMLINK at node_modules/.bin/teapot, and
+    // npm invokes the target THROUGH it. So `process.argv[1]` is the symlink path
+    // (…/node_modules/.bin/teapot), NOT the file it points at — which matched none
+    // of the checks below, `main()` never ran, and the installed command exited 0
+    // in silence. Reporting `teapot` did nothing and needing `node dist/index.js`
+    // was the only symptom. `realpathSync` is what resolves it.
+    try {
+        const self = realpathSync(fileURLToPath(import.meta.url));
+        const entry = realpathSync(arg);
+        if (self === entry)
+            return true;
+        // `self === entry` is the ONLY correct test: it is the definition of being the
+        // entry point. The suffix checks that used to follow were a fallback for the
+        // symlink case, and they were far too loose — `endsWith("/index.ts")` is true
+        // for EVERY test file that imports this module, so importing it booted a real
+        // server on port 7788 and `cli-args.test.ts` failed with EADDRINUSE.
+        //
+        // Keep a basename check as a safety net for a bundler that rewrites paths, but
+        // require BOTH that we are the module AND that nothing else is: an argv[1] that
+        // resolves to a DIFFERENT file is by definition not this module's entry.
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+if (isEntryPoint())
     void main();

package/dist/master.js

@@ -109,7 +109,18 @@ const DATA_DIR = process.env.TEAPOT_DATA_DIR ??
     path.join(os.homedir(), ".local", "share", "teapot-coding-agent");
 const DEFAULT_CONFIG = {
     port: Number(process.env.TEAPOT_PORT ?? 7788),
-    host: process.env.TEAPOT_HOST,
+    // #140: this was `process.env.TEAPOT_HOST`, i.e. UNDEFINED when unset — and an
+    // undefined hostname makes `@hono/node-server` bind every interface. So the
+    // default was the opposite of the documented one: `--help` says
+    // "127.0.0.1 (default) · 0.0.0.0 exposes the UI to your network", and yet the
+    // default WAS "expose to your network".
+    //
+    // Measured: with no --host the server answered on the machine's LAN address as
+    // well as loopback.
+    //
+    // Loopback is the right default for something holding API tokens and agent
+    // workspaces; exposing it has to be a deliberate act.
+    host: process.env.TEAPOT_HOST ?? "127.0.0.1",
     dataDir: DATA_DIR,
     llm: {
         baseUrl: process.env.TEAPOT_BASE_URL ?? "https://openrouter.ai/api/v1",
@@ -764,29 +775,42 @@ When this task is done (or truly blocked), call finish() with a summary for @${p
     /** Stop direct children (and their descendants by default) of an agent. */
     async stopChildrenFor(parentId, ids) {
         const stopped = [];
-        const walk = (pid) => {
+        // `inScope` is true once we are INSIDE a subtree we were asked to stop, and
+        // stays true all the way down.
+        //
+        // #142: the old walk passed `ids` down unchanged, so after matching an
+        // explicit id every DESCENDANT failed `ids.includes(id)` and was skipped —
+        // which is why the explicit branch hand-rolled its own one-level loop, and
+        // why that loop could not reach a great-grandchild.
+        const walk = (pid, inScope) => {
             for (const { id, agent } of this.childrenOf(pid)) {
-                if (ids && !ids.includes(id)) {
-                    // still descend: stopping a parent implies stopping its subtree
-                    walk(id);
+                const take = inScope || !ids || ids.includes(id);
+                if (!take) {
+                    // out of scope, but its own subtree may hold something in scope
+                    walk(id, false);
                     continue;
                 }
                 agent.stop("stopped by parent agent");
                 stopped.push(id);
-                if (ids) {
-                    // explicit id → also take its subtree
-                    const sub = this.childrenOf(id);
-                    for (const { id: gid, agent: g } of sub) {
-                        g.stop("stopped with parent");
-                        stopped.push(gid);
-                    }
-                }
-                else {
-                    walk(id); // full-subtree default
-                }
+                // #142: RECURSE for both modes.
+                //
+                // The explicit-id branch used to iterate `childrenOf(id)` exactly once, so
+                // a great-grandchild was never reached — stopping a child left its
+                // grandchild's child running, indefinitely, still holding a model
+                // connection and billing tokens:
+                //
+                //     root-sub           stopped
+                //     root-sub-sub       stopped
+                //     root-sub-sub-sub   running     <-- orphaned
+                //
+                // `walk` already means "this subtree", and it stops every node it visits,
+                // so one code path serves both cases. The only difference between the two
+                // modes is the `ids && !ids.includes(id)` test at the top, which decides
+                // whether a node is in scope — not how deep the walk goes.
+                walk(id, true);
             }
         };
-        walk(parentId);
+        walk(parentId, false);
         return { stopped };
     }
     /** Deliver a parent's message into a child's mailbox (and wake it). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teapot-coding-agent",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "A lightweight, always-on multi-agent harness for AI coding agents",
   "type": "module",
   "license": "AGPL-3.0-or-later",