@agfpd/iapeer 0.2.39 → 0.2.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.39",
+  "version": "0.2.41",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/cli/index.ts

@@ -1339,6 +1339,15 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
           return 1
         }
         out(`${r.woke ? 'woke + ' : ''}attaching ${r.identity}…\n`)
+        // Attach-window observability (killer-hunt 11.06: «была ли смерть под
+        // attach» was answerable only INDIRECTLY via wake cause=attach — i.e. only
+        // when the session was dead at attach time). Bracket the operator's client
+        // window in lifecycle.log: ev=attach at entry, ev=attach-end (with the tmux
+        // client's exit code) when the operator detaches or the server dies under
+        // the client. A death timestamp inside an attach…attach-end window now
+        // reads directly off the log.
+        const attachCfg = loadLifecycleConfig(env)
+        appendLifecycleEvent(attachCfg.eventLogDir, { ev: 'attach', identity: r.identity, woke: String(r.woke) }, { env })
         // Drop the operator into the session. `env -u TMUX` so a nested attach from
         // inside tmux does not error ("sessions should be nested with care").
         const attachEnv = { ...env }
@@ -1347,6 +1356,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
           stdio: 'inherit',
           env: attachEnv as Record<string, string>,
         })
+        appendLifecycleEvent(attachCfg.eventLogDir, { ev: 'attach-end', identity: r.identity, rc: a.status ?? -1 }, { env })
         return a.status ?? 0
       }
       default: {

package/src/init/index.ts

@@ -172,6 +172,41 @@ export function writeCodexMcpConfig(daemonUrl: string, options: StorageOptions =
   return { path, added: true }
 }
 
+/**
+ * Idempotently ensure codex's startup update-check DIALOG is disabled host-wide:
+ * `check_for_update_on_startup = false` as a TOP-LEVEL key in config.toml.
+ *
+ * Why (incident 11.06, codex-linus): the interactive "✨ Update available! …
+ * Press enter to continue" dialog is a BOOT GATE — a daemon-woken codex session
+ * sits on it until a human attaches. The wake reported never-became-ready after
+ * 4+ minutes and a notifier alert of the EMERGENCY contour (mining farm) was
+ * lost; the session came alive only from a manual attach. Warm-on-demand peers
+ * must reach ready hands-free — codex updates stay operator-driven (`codex
+ * update` / brew), never a boot-time question to a headless session.
+ *
+ * Mechanics: the key is a documented top-level config.toml option (present in
+ * the binary's own config schema; suppression PROVEN LIVE 11.06 on codex 0.138
+ * with the 0.139 update pending — control boot showed the dialog, the keyed
+ * boot went straight past it). A TOML top-level key must precede the first
+ * table header, so the key is PREPENDED — appending would land it inside the
+ * last [section]. An EXISTING `check_for_update_on_startup` of either value is
+ * respected (never override an explicit operator choice).
+ */
+export function ensureCodexUpdateCheckDisabled(
+  options: StorageOptions = {},
+): { path: string; changed: boolean } {
+  const path = codexConfigPath(options)
+  let existing = ''
+  try {
+    existing = readFileSync(path, 'utf8')
+  } catch {
+    /* no config yet → create it */
+  }
+  if (/^\s*check_for_update_on_startup\s*=/m.test(existing)) return { path, changed: false }
+  writeFileAtomic(path, `check_for_update_on_startup = false\n${existing}`, 0o644)
+  return { path, changed: true }
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Local doctrine template (<cwd>/.iapeer/IAPEER.md — personality/role; human fills)
 // ─────────────────────────────────────────────────────────────────────────────
@@ -304,6 +339,9 @@ export async function initPeer(opts: InitPeerOptions): Promise<InitPeerResult> {
   let codexMcpConfigPath: string | undefined
   if (provisioned.runtime === 'codex' || hasCodexMarker(provisioned.cwd)) {
     codexMcpConfigPath = writeCodexMcpConfig(daemonUrl, { env }).path
+    // Boot-gate hygiene (incident 11.06): a codex peer must never sit on the
+    // interactive update dialog at wake — disable the startup check host-wide.
+    ensureCodexUpdateCheckDisabled({ env })
   }
 
   const doctrine = ensureDoctrineTemplate(provisioned.cwd)

package/src/init/init.test.ts

@@ -9,6 +9,7 @@ import {
   CODEX_BEARER_ENV_VAR,
   IAPEER_MCP_SERVER_NAME,
   codexConfigPath,
+  ensureCodexUpdateCheckDisabled,
   ensureDoctrineTemplate,
   initPeer,
   resolveDaemonMcpUrl,
@@ -169,3 +170,44 @@ describe('initPeer orchestration', () => {
     expect(readFileSync(join(cwd, '.iapeer', 'IAPEER.md'), 'utf8')).toBe('custom doctrine')
   })
 })
+
+describe('ensureCodexUpdateCheckDisabled (boot-gate hygiene — incident 11.06 codex-linus)', () => {
+  test('PREPENDS the top-level key BEFORE the first [section] (TOML top-level scope)', () => {
+    const codexHome = mkdtempSync(join(tmpdir(), 'iapeer-codexhome3-'))
+    try {
+      const env: NodeJS.ProcessEnv = { ...process.env, CODEX_HOME: codexHome }
+      writeFileSync(codexConfigPath({ env }), 'model = "gpt-5.5"\n\n[projects."/x"]\ntrust_level = "trusted"\n')
+      const { changed } = ensureCodexUpdateCheckDisabled({ env })
+      expect(changed).toBe(true)
+      const toml = readFileSync(codexConfigPath({ env }), 'utf8')
+      expect(toml.startsWith('check_for_update_on_startup = false\n')).toBe(true)
+      expect(toml).toContain('[projects."/x"]') // existing config preserved
+      // idempotent: second run is a no-op
+      expect(ensureCodexUpdateCheckDisabled({ env }).changed).toBe(false)
+      expect((toml.match(/check_for_update_on_startup/g) ?? []).length).toBe(1)
+    } finally {
+      rmSync(codexHome, { recursive: true, force: true })
+    }
+  })
+  test('respects an EXPLICIT existing value (never overrides the operator)', () => {
+    const codexHome = mkdtempSync(join(tmpdir(), 'iapeer-codexhome4-'))
+    try {
+      const env: NodeJS.ProcessEnv = { ...process.env, CODEX_HOME: codexHome }
+      writeFileSync(codexConfigPath({ env }), 'check_for_update_on_startup = true\n')
+      expect(ensureCodexUpdateCheckDisabled({ env }).changed).toBe(false)
+      expect(readFileSync(codexConfigPath({ env }), 'utf8')).toContain('check_for_update_on_startup = true')
+    } finally {
+      rmSync(codexHome, { recursive: true, force: true })
+    }
+  })
+  test('absent config → created with just the key', () => {
+    const codexHome = mkdtempSync(join(tmpdir(), 'iapeer-codexhome5-'))
+    try {
+      const env: NodeJS.ProcessEnv = { ...process.env, CODEX_HOME: codexHome }
+      expect(ensureCodexUpdateCheckDisabled({ env }).changed).toBe(true)
+      expect(readFileSync(codexConfigPath({ env }), 'utf8')).toBe('check_for_update_on_startup = false\n')
+    } finally {
+      rmSync(codexHome, { recursive: true, force: true })
+    }
+  })
+})

package/src/launch/cmdlog.test.ts

@@ -0,0 +1,94 @@
+// tmux command-log (cmdlog.ts) — the killer-hunt socket-command layer.
+//
+// The live suite encodes boris's acceptance criterion directly: a kill-session
+// issued by an EXTERNAL client must land in the -v server log WITH client
+// attribution (`message: client-<pid> command: …`), file modes never wider than
+// 0600, and the cap keeps volume bounded without losing the tail.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
+import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, existsSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+import { spawnSync } from 'child_process'
+import {
+  CMDLOG_KEEP_BYTES,
+  capCmdLogs,
+  cmdLogDirFor,
+  hardenCmdLogDir,
+  prepareCmdLogDir,
+} from './cmdlog.ts'
+
+const tmuxAvailable = spawnSync('tmux', ['-V'], { stdio: 'ignore' }).status === 0
+
+let root: string
+beforeAll(() => {
+  root = mkdtempSync(join(tmpdir(), 'cmdlog-'))
+})
+afterAll(() => {
+  rmSync(root, { recursive: true, force: true })
+})
+
+describe('prepareCmdLogDir / hardenCmdLogDir / capCmdLogs (hermetic)', () => {
+  test('prepare WIPES the previous generation and recreates 0700', () => {
+    const dir = prepareCmdLogDir(root, 'claude-x')
+    expect(dir).toBe(cmdLogDirFor(root, 'claude-x'))
+    writeFileSync(join(dir!, 'tmux-server-1.log'), 'old generation')
+    const again = prepareCmdLogDir(root, 'claude-x')
+    expect(readdirSync(again!)).toEqual([]) // old log gone — one generation per dir
+    expect(statSync(again!).mode & 0o777).toBe(0o700)
+  })
+
+  test('harden clamps every file to 0600', () => {
+    const dir = prepareCmdLogDir(root, 'claude-h')!
+    writeFileSync(join(dir, 'tmux-server-2.log'), 'x', { mode: 0o644 })
+    hardenCmdLogDir(dir)
+    expect(statSync(join(dir, 'tmux-server-2.log')).mode & 0o777).toBe(0o600)
+  })
+
+  test('cap tail-keeps an oversized log (KEEP bytes of TAIL survive), leaves small logs alone', () => {
+    const dir = prepareCmdLogDir(root, 'claude-c')!
+    const big = join(dir, 'tmux-server-3.log')
+    const small = join(dir, 'tmux-server-4.log')
+    // 2 MB of filler ending in a recognizable tail — cap to 1 KB keep for the test
+    writeFileSync(big, Buffer.concat([Buffer.alloc(2 * 1024 * 1024, 0x61), Buffer.from('THE-DEATH-TAIL')]))
+    writeFileSync(small, 'tiny')
+    const capped = capCmdLogs(root, 1024 * 1024, 1024)
+    expect(capped).toEqual([big])
+    const after = readFileSync(big)
+    expect(after.length).toBe(1024)
+    expect(after.toString()).toEndWith('THE-DEATH-TAIL') // the tail is what survives
+    expect(readFileSync(small, 'utf8')).toBe('tiny')
+  })
+
+  test('cap on a missing tree is a silent no-op', () => {
+    expect(capCmdLogs(join(root, 'absent'))).toEqual([])
+  })
+
+  test('default keep constant stays under the cap', () => {
+    expect(CMDLOG_KEEP_BYTES).toBeLessThan(8 * 1024 * 1024)
+  })
+})
+
+describe.if(tmuxAvailable)('live -v server log (acceptance criterion)', () => {
+  test('external client kill-session lands in the server log with client attribution; harden → 0600', () => {
+    const dir = prepareCmdLogDir(root, 'claude-live')!
+    const sock = join(root, 'live.sock')
+    // Start the server FROM the cmdlog dir with -v — exactly the launch wiring.
+    const start = spawnSync('tmux', ['-S', sock, '-v', 'new-session', '-d', '-x', '80', '-y', '24', '-s', 'claude-live', 'sleep 60'], {
+      cwd: dir,
+      encoding: 'utf8',
+    })
+    expect(start.status).toBe(0)
+    hardenCmdLogDir(dir)
+    // An EXTERNAL client (separate tmux invocation = separate client pid) kills it.
+    const kill = spawnSync('tmux', ['-S', sock, 'kill-session', '-t', 'claude-live'], { encoding: 'utf8' })
+    expect(kill.status).toBe(0)
+    const serverLog = readdirSync(dir).find(f => f.startsWith('tmux-server-'))
+    expect(serverLog).toBeDefined()
+    expect(statSync(join(dir, serverLog!)).mode & 0o777).toBe(0o600)
+    const text = readFileSync(join(dir, serverLog!), 'utf8')
+    // Attribution line: message: client-<pid> command: kill-session -t claude-live
+    expect(text).toMatch(/message: client-\d+ command: kill-session -t claude-live/)
+    spawnSync('tmux', ['-S', sock, 'kill-server'], { stdio: 'ignore' })
+  })
+})

package/src/launch/cmdlog.ts

@@ -0,0 +1,130 @@
+// tmux command-log — the SOCKET-COMMAND observability layer of the killer hunt.
+//
+// Why (death class 11.06, boris's session-deaths track): a tmux server killed by a
+// CLIENT COMMAND (`kill-server` / `kill-session` over the unix socket) dies with
+// zero signals — structurally invisible to ALL THREE existing layers: the eslogger
+// trap (no kill(2) anywhere; kernel-originated SIGHUP to the panes is also proven
+// invisible), the pane-died hook (kill-session destroys the pane without retention)
+// and the server-death canary (sees only "server gone"). The tmux server's OWN
+// verbose log is the only witness of that layer: started with `-v`, the server
+// appends `message: client-<pid> command: <verb> <args>` for every client command —
+// the attribution (client pid + exact command + timestamp) that decides the class
+// binarily: "killed by client X" vs "no command ⇒ internal exit".
+//
+// Sensitivity (boris's requirement): the -v log carries FULL send-keys payloads
+// (every delivered envelope, plaintext) — tmux has no commands-only level and the
+// server writes the file itself (name tmux-server-<pid>.log in the STARTING
+// client's cwd — no FIFO/pipe interposition possible). Containment instead:
+//   • the per-identity dir is 0700 (others cannot traverse — same protection class
+//     as the transcripts that already hold the same texts);
+//   • files are chmod'ed 0600 right after the server starts (hardenCmdLogDir);
+//   • volume is capped: ~7 KB/s under a 10 fps TUI redraw (measured) — the
+//     supervise tick tail-keeps each log over CAP_BYTES down to KEEP_BYTES.
+//     tmux writes with O_APPEND (proven live: external truncation is safe, the
+//     server keeps appending at the new EOF), and a killer's command is by nature
+//     the LAST thing in the log — the death tail always survives capping.
+//   • scope: agent-runtime (warm) sessions only — always-on infra sessions relaunch
+//     rarely (no rotation point) and are not the dying class.
+// Rotation: prepareCmdLogDir WIPES the identity dir on every launch — one server
+// generation per dir, no unbounded accumulation across relaunches.
+//
+// Best-effort BY CONSTRUCTION: observability must never fail a launch or a
+// supervise tick — every export swallows FS errors.
+
+import { chmodSync, mkdirSync, openSync, closeSync, readSync, readdirSync, rmSync, statSync, writeFileSync, fstatSync } from 'fs'
+import { join } from 'path'
+
+/** Tail-keep cap: a log over CAP_BYTES is cut down to its last KEEP_BYTES. */
+export const CMDLOG_CAP_BYTES = 8 * 1024 * 1024
+export const CMDLOG_KEEP_BYTES = 1024 * 1024
+
+const CMDLOG_SUBDIR = 'tmux-cmdlog'
+
+/** The per-identity command-log dir: <eventLogDir>/tmux-cmdlog/<identity>. The
+ *  session-creating tmux client runs FROM this dir with `-v`, so the server drops
+ *  tmux-server-<pid>.log (and the client its tmux-client-*.log) here. */
+export function cmdLogDirFor(eventLogDir: string, identity: string): string {
+  return join(eventLogDir, CMDLOG_SUBDIR, identity)
+}
+
+/** Wipe + recreate the identity's command-log dir (0700) for a fresh server
+ *  generation. Returns the dir, or undefined when the FS refuses (the caller then
+ *  launches WITHOUT -v — observability is never load-bearing). */
+export function prepareCmdLogDir(eventLogDir: string, identity: string): string | undefined {
+  try {
+    const dir = cmdLogDirFor(eventLogDir, identity)
+    rmSync(dir, { recursive: true, force: true })
+    mkdirSync(dir, { recursive: true, mode: 0o700 })
+    return dir
+  } catch {
+    return undefined
+  }
+}
+
+/** Clamp every file the freshly-started server/client dropped into the dir to
+ *  0600 (the dir's 0700 already blocks traversal; this is the belt to that
+ *  suspender — boris's acceptance criterion: no file wider than 0600). */
+export function hardenCmdLogDir(dir: string): void {
+  try {
+    for (const name of readdirSync(dir)) {
+      try {
+        chmodSync(join(dir, name), 0o600)
+      } catch {
+        /* per-file best-effort */
+      }
+    }
+  } catch {
+    /* dir gone — nothing to harden */
+  }
+}
+
+/** Tail-keep cap over every command log under <eventLogDir>/tmux-cmdlog/<identity>.
+ *  A file over capBytes is rewritten as its last keepBytes. Safe against the
+ *  live writer: tmux logs with O_APPEND, so the server's next write lands at
+ *  the new EOF (proven by live truncation test). Lines appended between the
+ *  tail-read and the rewrite are lost — acceptable mid-life noise; the death
+ *  tail is never here because the peer is alive while being capped. */
+export function capCmdLogs(
+  eventLogDir: string,
+  capBytes: number = CMDLOG_CAP_BYTES,
+  keepBytes: number = CMDLOG_KEEP_BYTES,
+): string[] {
+  const capped: string[] = []
+  let identities: string[]
+  try {
+    identities = readdirSync(join(eventLogDir, CMDLOG_SUBDIR))
+  } catch {
+    return capped
+  }
+  for (const identity of identities) {
+    const dir = join(eventLogDir, CMDLOG_SUBDIR, identity)
+    let files: string[]
+    try {
+      files = readdirSync(dir)
+    } catch {
+      continue
+    }
+    for (const name of files) {
+      if (!name.endsWith('.log')) continue
+      const path = join(dir, name)
+      try {
+        if (statSync(path).size <= capBytes) continue
+        const fd = openSync(path, 'r')
+        let tail: Buffer
+        try {
+          const size = fstatSync(fd).size
+          const start = Math.max(0, size - keepBytes)
+          tail = Buffer.alloc(Math.min(keepBytes, size))
+          readSync(fd, tail, 0, tail.length, start)
+        } finally {
+          closeSync(fd)
+        }
+        writeFileSync(path, tail, { mode: 0o600 })
+        capped.push(path)
+      } catch {
+        /* per-file best-effort */
+      }
+    }
+  }
+  return capped
+}

package/src/launch/index.ts

@@ -20,6 +20,7 @@ import { spawnSync } from 'child_process'
 import { CODEX_BEARER_ENV_VAR, CODEX_DUMMY_BEARER, type Runtime } from '../core/constants.ts'
 import { readLaunchEnv } from '../storage/index.ts'
 import { canaryChannel, dismissCanary, ensureServerCanary, exitLogPath, signalCanaryClean } from './canary.ts'
+import { hardenCmdLogDir, prepareCmdLogDir } from './cmdlog.ts'
 import { appendLifecycleEvent } from '../lifecycle/eventlog.ts'
 import { claudeAdapter } from './adapters/claude.ts'
 import { codexAdapter } from './adapters/codex.ts'
@@ -262,14 +263,31 @@ export const launch: LaunchFn = async (
     PEER_IDENTITY: identity,
     PATH: env.PATH ?? `${homedir()}/.bun/bin:${homedir()}/.local/bin:/opt/homebrew/bin:/usr/bin:/bin`,
   }
+  // (2.4) tmux command-log (killer-hunt socket-command layer, cmdlog.ts): WARM
+  //       agent sessions start their server with `-v` so every client command —
+  //       incl. a killer's `kill-server`/`kill-session`, invisible to signal
+  //       forensics — lands in tmux-server-<pid>.log with client attribution
+  //       (`message: client-<pid> command: …`). The starting client runs FROM the
+  //       per-identity 0700 cmdlog dir (that is where tmux drops the logs; the
+  //       pane's cwd is still `-c cwd`). Gated like the other observability layers
+  //       on cfg.exitLogDir; skipped for always-on infra (rare relaunch = no
+  //       rotation point, and not the dying class). Best-effort: a failed dir
+  //       prepare just launches without -v.
+  const cmdLogDir = !cfg.alwaysOn && cfg.exitLogDir ? prepareCmdLogDir(cfg.exitLogDir, identity) : undefined
   const start = spawnSync(
     'tmux',
-    ['-S', sock, 'new-session', '-d', '-s', identity, '-x', '220', '-y', '50', '-c', cwd, runtimeCmd],
-    { env: childEnv as Record<string, string>, encoding: 'utf8' },
+    [
+      '-S', sock,
+      ...(cmdLogDir ? ['-v'] : []),
+      'new-session', '-d', '-s', identity, '-x', '220', '-y', '50', '-c', cwd, runtimeCmd,
+    ],
+    { env: childEnv as Record<string, string>, encoding: 'utf8', ...(cmdLogDir ? { cwd: cmdLogDir } : {}) },
   )
   if (start.status !== 0) {
     return fail(identity, `tmux new-session failed: ${(start.stderr ?? '').trim() || 'exit ' + start.status}`)
   }
+  // The server/client logs exist once new-session returns — clamp them to 0600.
+  if (cmdLogDir) hardenCmdLogDir(cmdLogDir)
 
   // (2.5) Exit-cause observability: a `pane-died` hook that records WHY this
   //       session's process dies (status/signal) at the moment of death into

package/src/lifecycle/index.ts

@@ -26,6 +26,7 @@ import {
 } from '../core/constants.ts'
 import { buildProcessAddress, buildSocketPath, parseSessionName } from '../core/socket.ts'
 import { err, ok, type Result } from '../core/errors.ts'
+import { capCmdLogs } from '../launch/cmdlog.ts'
 import { resolveGlobalRoot } from '../storage/index.ts'
 import { readPeerProfile, resolveIdentity } from '../identity/index.ts'
 import {
@@ -1071,6 +1072,11 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
   const env = deps.env ?? process.env
   const nowMs = deps.nowMs ?? Date.now()
   const verbose = superviseLogVerbose(env)
+  // tmux command-log volume cap (killer-hunt socket-command layer, launch/cmdlog.ts):
+  // a -v server log under a busy TUI grows ~7 KB/s, so each tick tail-keeps any log
+  // over the cap. Best-effort by construction; the killer's command is the LAST
+  // line of a dying log, so capping a LIVE peer's log never costs the death tail.
+  capCmdLogs(cfg.eventLogDir)
   // Durable decision trace (eventlog.ts): every reap/death/eager-fresh gets a line
   // so a postmortem can answer "when & how did peer X's prior session end" even
   // after the .idle-reaped / .deaths markers are consumed. alive / skipped-launchd