teapot-coding-agent 0.37.59 → 0.37.60

package/dist/bus.js

@@ -1,4 +1,3 @@
 import { EventEmitter } from "node:events";
-/** Tiny process-wide pub/sub used to push updates to SSE clients (no polling). */
 export const bus = new EventEmitter();
-bus.setMaxListeners(1000); // one per connected client (WS + SSE) — headroom for busy LAN setups
+bus.setMaxListeners(1000);

package/dist/config-schema.js

@@ -1,21 +1,7 @@
-/**
- * Zod schema for teapot's config — the single source of truth for what a
- * valid config looks like, used to gate web-UI edits (PUT /api/config) and any
- * programmatic writes with human-readable error messages.
- *
- * Validation gates; it is not the storage format — the master persists the raw
- * user JSON so unknown fields survive round-trips.
- */
 import { z } from "zod";
 export const ProviderSchema = z.object({
     baseUrl: z.union([z.string().url("baseUrl must be a valid URL"), z.literal("")]).optional(),
     apiKey: z.string().optional(),
-    /**
-     * Several credentials for ONE provider, rotated round-robin (#170). Blank entries
-     * are rejected rather than silently dropped: the operator wrote them, and a key
-     * that vanishes without a word is how "I added 3 keys but it still rate-limits"
-     * happens.
-     */
     apiKeys: z
         .array(z.string().min(1, "an api key entry must not be empty"))
         .max(50, "at most 50 keys per provider")
@@ -41,45 +27,20 @@ export const TaskSchema = z.object({
     prompt: z.string().min(1, "prompt required"),
     forked: z.boolean().optional(),
 });
-/** the patch shape accepted by PUT /api/config */
 export const ConfigPatchSchema = z.object({
     providers: z.record(z.string().min(1, "provider name required"), ProviderSchema).optional(),
     defaultProvider: z.string().optional(),
     progressIntervalMs: z.number().int().min(10_000, "progress interval must be ≥ 10s").optional(),
     progressMinChars: z.number().int().min(100).optional(),
-    // null clears a previously pinned compact budget → back to per-model derivation
     contextTokenBudget: z.number().int().min(1_000).nullable().optional(),
-    // null clears a saved window pin → back to per-model inference (same contract as contextTokenBudget)
     contextWindowTokens: z.number().int().min(1_000).nullable().optional(),
     maxSpawnDepth: z.number().int().min(0).max(8).optional(),
-    /**
-     * The shared secret protecting `/api/*` — settable from the settings panel.
-     *
-     * It used to be reachable only through `POST /api/setup`, which refuses once a config file exists.
-     * That was fine while the first-run wizard existed; the wizard is gone, so there was NO way to set
-     * a password at all. Asked as "初回起動ウィザードは前に廃止したはずだからパスワード設定できないの
-     * では?" — correct.
-     *
-     * An EMPTY STRING is meaningful and clears it (back to loopback-only trust), which is why this
-     * accepts `""` rather than requiring a minimum length. `TEAPOT_API_TOKEN` still wins over it.
-     */
     password: z.string().max(200).optional(),
-    /** #161: prune old tool output early (opt-in, for small-window models) */
     shortContext: z.boolean().optional(),
-    // soft cap on LLM turns in one round; reaching it nudges the model to wrap
-    // up (not an error) — 0 disables the cap
     maxTurnsPerRound: z.number().int().min(0).optional(),
-    // round-fatal API errors: "stop" (default) or "retry" (back off + fresh
-    // round — for unattended agents that should ride out outages)
     onError: z.enum(["stop", "retry"]).optional(),
     retryDelayMs: z.number().int().min(1_000).optional(),
     tasks: z.array(TaskSchema).optional(),
-    /**
-     * MCP servers (#67). Validated here so a bad entry fails the SAVE with a readable
-     * message instead of surfacing later as a tool that never appears: a stdio server
-     * needs a command, a network one needs a url, and the name is what namespaces every
-     * tool it exposes.
-     */
     mcpServers: z
         .array(z
         .object({
@@ -101,7 +62,6 @@ export const ConfigPatchSchema = z.object({
     }))
         .optional(),
 });
-/** Format a ZodError into a compact operator-readable message. */
 export function formatZodError(error) {
     return error.issues
         .map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`)

package/dist/home.js

@@ -1,24 +1,8 @@
-/**
- * The user's home directory, on every platform (#110).
- *
- * `process.env.HOME` is a POSIX convention and is normally UNSET on Windows, so
- * expanding `~` with `process.env.HOME ?? "~"` produced the LITERAL "~" there —
- * and since the result reached `path.resolve` + `mkdirSync`, teapot created a
- * directory named `~`.
- *
- * The `env` parameters exist so a test can drive the Windows shape
- * deterministically; `os.homedir()` on a Linux CI box would report `/root` and
- * hide the condition under test.
- */
-/** @returns "" when no home is known — callers leave `~` alone rather than invent a path */
 export function homeDir(env = process.env) {
     if (env.HOME)
         return env.HOME;
     if (env.USERPROFILE)
         return env.USERPROFILE;
-    // Windows can report HOMEDRIVE + HOMEPATH. Both must be present:
-    // `undefined + path` yields the STRING "undefined", which is exactly the class
-    // of bug this helper exists to remove.
     const drive = env.HOMEDRIVE;
     const rest = env.HOMEPATH;
     if (drive && rest)
@@ -27,13 +11,11 @@ export function homeDir(env = process.env) {
         return drive;
     return "";
 }
-/** Expand a leading `~`. One place, so the Windows case cannot be got wrong twice (#110). */
 export function expandTilde(input, env = process.env) {
-    // a Windows path can be `~\foo`, hence the backslash in the lookahead
     if (!/^~(?=$|[/\\])/.test(input))
         return input;
     const home = homeDir(env);
     if (!home)
-        return input; // no home known: leaving `~` is more honest than inventing one
+        return input;
     return input.replace(/^~(?=$|[/\\])/, home);
 }

package/dist/index.js

@@ -1,52 +1,20 @@
 #!/usr/bin/env node
-/**
- * teapot master entry point.
- * Usage: teapot [--port N] [--host addr] [--config file.json] [config.json]
- * Config may also come from TEAPOT_* env vars (see src/master.ts).
- * First run (no config file): boot anyway and finish setup in the web UI.
- */
 import { existsSync, realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { loadConfig, resolveConfigPath, Master } from "./master.js";
 import { buildApp, serveApp } from "./server/api.js";
-/**
- * Parse `teapot [--port N] [-p N] [--host addr] [--config file] [config.json]`.
- *
- * Exported so it can be tested: the parser decides which config file is read and
- * which port is bound, so a regression here starts the wrong server on the wrong
- * port with no error anyone would read.
- *
- * The bare-word rule keeps the FIRST positional as the config path: a later bare
- * word is a stray argument, not an override, and silently replacing the config
- * with it would be worse than ignoring it.
- *
- * BOTH spellings are accepted: `--host 0.0.0.0` and `--host=0.0.0.0`. Only the
- * space-separated form used to parse, so `--host=0.0.0.0` — the spelling people
- * reach for, and the one every other CLI accepts — was silently DISCARDED and the
- * server came up on loopback with nothing readable to say why. Reported as
- * "--host が効いてない、0.0.0.0 にしても他デバイスからアクセスできない", and a
- * silently-ignored flag is the worst possible shape for this: the operator sees a
- * server that started fine and blames their network.
- */
 export function parseArgs(argv) {
     let cfgArg;
     let portOverride;
     let hostOverride;
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
-        // `--name=value` and `--name value` both work. Splitting here means every
-        // branch below sees the plain name and reads its value the same way, so a
-        // future flag cannot repeat the `--host=` omission.
         const eq = a.startsWith("--") ? a.indexOf("=") : -1;
         const name = eq === -1 ? a : a.slice(0, eq);
-        // for `--name=value` the value is already in `a`; otherwise take the next word
         const value = () => (eq === -1 ? argv[++i] : a.slice(eq + 1));
         if (name === "--port" || name === "-p") {
             const raw = value();
             const n = Number(raw);
-            // NaN is dropped rather than applied: `config.port = NaN` would fall through
-            // to the listen call and produce a far more confusing failure than ignoring
-            // a mistyped flag
             if (!Number.isNaN(n))
                 portOverride = n;
         }
@@ -79,15 +47,6 @@ async function main() {
     if (hostOverride)
         config.host = hostOverride;
     console.log(`[teapot] config: ${configPath}${configExisted ? "" : " (not found — first run)"}`);
-    /**
-     * NO PORT HANDOVER DANCE.
-     *
-     * This used to read `TEAPOT_RESTART_FROM`, SIGTERM the predecessor and poll until the port was
-     * free, because the successor was a SEPARATE process racing the old one for one socket. The live
-     * update now replaces the process in place with `process.execve`, so the pid never changes: the
-     * exec releases the listener as part of replacing the image (verified) and this process is the
-     * only one that ever binds. The whole EADDRINUSE window #35 worked around cannot occur.
-     */
     const hasProviders = Object.keys(config.providers ?? {}).length > 0;
     if (!config.llm.apiKey && !hasProviders)
         console.warn("[teapot] warning: no API key configured — finish setup in the web UI");
@@ -96,64 +55,24 @@ async function main() {
     const master = new Master(config, configPath);
     master.configFileExists = configExisted;
     await master.start();
-    /**
-     * LIVE UPDATE: resume what the previous image was running.
-     *
-     * The set was written to the config by `restartServer()` immediately before the exec, because
-     * after a restart the log cannot tell "was working when the update hit" from "finished" or
-     * "stopped by the operator" — resuming every configured agent would start work nobody asked for,
-     * and resuming none is the bug being fixed ("サーバーを再起動して動作中だったセッションのエージェント
-     * ループを再開").
-     *
-     * Deliberately AFTER `start()` so the agents exist, and BEFORE the port is served so the operator
-     * reloading the page sees the resumed sessions already moving.
-     */
     if (process.env.TEAPOT_RESUMED) {
         delete process.env.TEAPOT_RESUMED;
         const resumed = await master.resumeAfterUpdate();
         if (resumed.length)
             console.log(`[teapot] live update: ${resumed.length} session(s) resumed`);
     }
-    // ACP mode (#15): JSON-RPC over stdio, no HTTP server. Deliberately placed
-    // AFTER the master is up (so config is resolved and agents work) but BEFORE
-    // serveApp, so an editor launching `teapot --acp` never binds a port.
     if (process.argv.includes("--acp")) {
         const { AcpAdapter } = await import("./acp/adapter.js");
         const acp = new AcpAdapter({ master });
-        // nothing else may write to stdout — it carries the protocol
         console.error("[teapot] ACP mode: JSON-RPC over stdio");
         await acp.listen();
         return;
     }
     const app = buildApp(master);
-    // kept for the process lifetime; nothing closes it explicitly any more (the supervisor
-    // branch that did is gone — `process.execve` replaces the image and releases the socket)
     serveApp(app, config.port, config.host);
-    /**
-     * Say out loud when the API has no auth, and when it is reachable beyond loopback.
-     *
-     * The OpenCode advisory (CVE-2026-22812) was not just "a server was open" — it was open and
-     * nobody knew. `apiToken()` is empty on a fresh install because the setup wizard sets the
-     * password THROUGH the API, so a token cannot be demanded before one exists; the honest response
-     * is to make the state visible on every start rather than to pretend it is protected.
-     *
-     * See docs/security-advisories.md.
-     */
     const noAuth = !(process.env.TEAPOT_API_TOKEN || master.config.password);
     const beyondLoopback = !!config.host && config.host !== "127.0.0.1" && config.host !== "localhost";
     if (noAuth) {
-        /**
-         * On LOOPBACK this is the normal, safe default — so say so plainly instead of printing an
-         * alarming "no API token set" on every start.
-         *
-         * Asked as "no API token setはなんだろう": nothing is wrong. On loopback only this machine can
-         * connect, so an unset password is the safe default rather than a fault — and it is settable in
-         * settings → live update (it uses to be reachable only through the first-run wizard, which was
-         * removed). The message now says that, on stdout at info level; `console.error` made a healthy
-         * start look like a fault.
-         *
-         * The WARNING branch is unchanged and still goes to stderr: that one IS a problem.
-         */
         if (!beyondLoopback) {
             console.log("[teapot] auth: none needed — bound to loopback only, so only this machine can reach /api. " +
                 "Set TEAPOT_API_TOKEN or config.password before exposing this port.");
@@ -163,8 +82,6 @@ async function main() {
                 "drive the agents. Set TEAPOT_API_TOKEN or config.password now.");
         }
     }
-    // agent crash isolation: an agent error never escapes its own loop; here we
-    // also make sure the process survives unexpected rejections.
     process.on("uncaughtException", (err) => {
         console.error("[teapot] uncaught exception (master survived):", err);
     });
@@ -176,56 +93,15 @@ async function main() {
         if (shuttingDown)
             return;
         shuttingDown = true;
-        /**
-         * THERE IS NO SUPERVISOR MODE ANY MORE — and removing it IS the memory-leak fix.
-         *
-         * The old live update spawned a successor and stayed resident as its supervisor, polling
-         * `pidAlive(replacement)` every 500ms for the ENTIRE lifetime of the new server. Everything
-         * this process owned stayed alive with it: every agent object and its log handles, every `bus`
-         * listener, the 15s master tick, plus three MORE signal handlers that `supervise()` added on
-         * top of the ones `shutdown()` had already registered. Each update therefore left another full
-         * copy of the server resident, which is the reported leak.
-         *
-         * `restartServer()` now replaces the image in place with `process.execve`, so there is no
-         * successor to supervise: the exec reuses this pid, this process group and this terminal, so
-         * nothing is orphaned and nothing lingers. `execve` only resolves if it FAILED, and that path
-         * throws inside `restartServer`, so nothing is left trusting this branch.
-         */
-        /**
-         * Ctrl-C during a live update must not cancel the handover half-way.
-         *
-         * `restartServer()` records what to resume and then execs. A SIGINT in that window ran this
-         * shutdown path, which DISPOSES every agent and exits — so the operator saw
-         *
-         *     [teapot] live update: waiting for 1 agent(s)…
-         *     ^C
-         *     [teapot] shutting down (SIGINT)...
-         *     [teapot] live update: 0 session(s) will resume
-         *
-         * and the work that was running never came back. The flag is set by `restartServer()` for the
-         * whole duration of the handover, which is exactly the window where the operator's ^C is
-         * ambiguous: it can mean "cancel the update" or "stop the server", and treating it as the latter
-         * silently discards the resume set that was just written.
-         *
-         * A second ^C while an update is in flight is the escape hatch — that is why this checks the
-         * signal rather than ignoring it outright.
-         */
         const updating = master.updateInFlight === true;
         if (updating && signal === "SIGINT" && !process.env.TEAPOT_FORCE_SHUTDOWN) {
             console.log("\n[teapot] live update is in progress — press ^C again to abort it and stop");
             process.env.TEAPOT_FORCE_SHUTDOWN = "1";
-            // do NOT reset `shuttingDown`: the next signal must get through, so clear it
             shuttingDown = false;
             return;
         }
         console.log(`\n[teapot] shutting down${signal ? ` (${signal})` : ""}...`);
         await Promise.allSettled([...master.agents.values()].map((a) => a.dispose()));
-        // During a live update the replacement SIGTERMs us to take the port. Linger
-        // so our own in-flight HTTP responses flush first — notably
-        // /api/update/restart, whose answer the browser is still waiting on; the
-        // socket is released the moment we exit, which is what lets the replacement
-        // bind. We must NOT wait for the replacement to come up: it is itself
-        // waiting for this port to free, so that would deadlock the handover (#35).
         if (process.env.TEAPOT_RESTART_FROM)
             await new Promise((r) => setTimeout(r, 1_500));
         process.exit(0);
@@ -233,27 +109,15 @@ async function main() {
     process.on("SIGINT", () => void shutdown("SIGINT"));
     process.on("SIGTERM", () => void shutdown("SIGTERM"));
 }
-// Only when RUN, not when imported: `void main()` at module scope meant importing
-// this file for `parseArgs` started a whole server. `node
-// --experimental-strip-types src/index.ts` and `node dist/index.js` both take
-// this branch.
 function isEntryPoint() {
     const arg = process.argv[1];
     if (!arg)
         return false;
-    // `npm i -g teapot-coding-agent` puts a SYMLINK at node_modules/.bin/teapot and
-    // npm invokes the target THROUGH it, so `process.argv[1]` is the symlink path,
-    // NOT the file it points at: the installed command then exited 0 in silence.
-    // `realpathSync` is what resolves it.
     try {
         const self = realpathSync(fileURLToPath(import.meta.url));
         const entry = realpathSync(arg);
         if (self === entry)
             return true;
-        // `self === entry` is the ONLY correct test: it is the definition of being the
-        // entry point. A suffix check such as `endsWith("/index.ts")` is true for
-        // EVERY test file that imports this module, so importing it booted a real
-        // server on port 7788 and `cli-args.test.ts` failed with EADDRINUSE.
         return false;
     }
     catch {