@agfpd/iapeer 0.2.44 → 0.2.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.44",
+  "version": "0.2.46",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/cli/cli.test.ts

@@ -7,7 +7,7 @@ import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
 import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'fs'
 import { tmpdir } from 'os'
 import { join } from 'path'
-import { formatListTable, listPeers, newPeer, parseArgs, removePeerCli, runCli, sendMessage, startPeer, stopPeer } from './index.ts'
+import { addRuntime, defaultRuntime, formatListTable, listPeers, newPeer, parseArgs, removePeerCli, runCli, sendMessage, startPeer, stopPeer } from './index.ts'
 import { findPeer, readPeersIndex, upsertPeer } from '../registry/index.ts'
 import { hasIdleReaped, isStopped, loadLifecycleConfig, setIdleReaped, setStopped } from '../lifecycle/index.ts'
 import { launchdPlistPath } from '../launch/launchd.ts'
@@ -451,3 +451,78 @@ describe('new (unconditional fresh restart)', () => {
     await expect(newPeer('ghost-nobody', undefined, { env: e })).rejects.toThrow('not registered')
   })
 })
+
+// ─── add-runtime / default-runtime — the fleet-switch levers (codex-parity) ───
+
+describe('add-runtime / default-runtime (fleet-switch levers)', () => {
+  test('add-runtime merges the runtime into profile+registry; idempotent; infra peers skipped', async () => {
+    const e = env()
+    // a claude-only peer with a REAL cwd (initPeer scaffolds it)
+    const cwd = join(root, 'peers', 'aud1')
+    mkdirSync(cwd, { recursive: true })
+    await upsertPeer({ personality: 'aud1', runtime: 'claude', cwd, intelligence: 'artificial' }, { rootDir: root })
+    const { initPeer } = await import('../init/index.ts')
+    await initPeer({ cwd, runtime: 'claude', env: e }) // give it a local profile (claude-only)
+    // an infra peer in the registry — must be skipped by --all
+    await register('tginfra', 'telegram', 'natural')
+    const outcomes = await addRuntime('codex', { all: true, env: e })
+    const aud1 = outcomes.find(o => o.personality === 'aud1')!
+    expect(aud1.action).toBe('added')
+    expect(outcomes.find(o => o.personality === 'tginfra')!.action).toBe('skipped-infra-peer')
+    // profile + registry both carry codex now; default untouched
+    const { readPeerProfile } = await import('../identity/index.ts')
+    const prof = readPeerProfile(cwd)!
+    expect(prof.runtimes).toContain('codex')
+    expect(prof.runtime).toBe('claude') // default_runtime NOT flipped
+    const rec = findPeer(readPeersIndex({ env: e }), 'aud1')!
+    expect(rec.runtimes).toContain('codex')
+    expect(rec.runtime).toBe('claude') // registry default NOT flipped (capability ≠ routing; live-caught: upsert's «args.runtime wins» needed the reindex heal)
+    // idempotent
+    expect((await addRuntime('codex', { peer: 'aud1', env: e }))[0].action).toBe('already')
+  })
+
+  test('add-runtime works from INSIDE another peer session (poisoned PEER_* env) — live-caught 12.06', async () => {
+    const e = env()
+    e.PEER_PERSONALITY = 'iapeer' // the caller's own identity must not poison the target's init
+    e.PEER_RUNTIME = 'claude'
+    e.PEER_IDENTITY = 'claude-iapeer'
+    const cwd = join(root, 'peers', 'aud3')
+    mkdirSync(cwd, { recursive: true })
+    await upsertPeer({ personality: 'aud3', runtime: 'claude', cwd, intelligence: 'artificial' }, { rootDir: root })
+    const { initPeer } = await import('../init/index.ts')
+    const cleanE = { ...e }
+    delete cleanE.PEER_PERSONALITY; delete cleanE.PEER_RUNTIME; delete cleanE.PEER_IDENTITY
+    await initPeer({ cwd, runtime: 'claude', env: cleanE })
+    const outcomes = await addRuntime('codex', { peer: 'aud3', env: e })
+    expect(outcomes[0].action).toBe('added')
+  })
+
+  test('add-runtime refuses an infra runtime as the argument', async () => {
+    await register('x1')
+    await expect(addRuntime('telegram', { peer: 'x1', env: env() })).rejects.toThrow('infra runtime')
+  })
+
+  test('default-runtime flips the primary (profile + registry in one command); refuses undeclared; symmetric back', async () => {
+    const e = env()
+    const cwd = join(root, 'peers', 'aud2')
+    mkdirSync(cwd, { recursive: true })
+    await upsertPeer({ personality: 'aud2', runtime: 'claude', cwd, intelligence: 'artificial' }, { rootDir: root })
+    const { initPeer } = await import('../init/index.ts')
+    await initPeer({ cwd, runtime: 'claude', env: e })
+    // undeclared codex → explicit refusal with the add-runtime hint
+    const refused = await defaultRuntime('codex', { peer: 'aud2', env: e })
+    expect(refused[0].action).toBe('refused-undeclared-runtime')
+    expect(refused[0].detail).toContain('add-runtime')
+    // declare codex, then flip
+    await addRuntime('codex', { peer: 'aud2', env: e })
+    expect((await defaultRuntime('codex', { peer: 'aud2', env: e }))[0].action).toBe('flipped')
+    const { readPeerProfile } = await import('../identity/index.ts')
+    expect(readPeerProfile(cwd)!.runtime).toBe('codex')
+    expect(readPeerProfile(cwd)!.runtimes[0]).toBe('codex') // normalizeRuntimes prepends the default
+    expect(findPeer(readPeersIndex({ env: e }), 'aud2')!.runtime).toBe('codex') // registry healed same-command
+    // idempotent + symmetric revert
+    expect((await defaultRuntime('codex', { peer: 'aud2', env: e }))[0].action).toBe('already')
+    expect((await defaultRuntime('claude', { peer: 'aud2', env: e }))[0].action).toBe('flipped')
+    expect(findPeer(readPeersIndex({ env: e }), 'aud2')!.runtime).toBe('claude')
+  })
+})

package/src/cli/index.ts

@@ -47,7 +47,7 @@ import {
 } from '../lifecycle/index.ts'
 import { getAdapter } from '../launch/index.ts'
 import { cycleDaemon, isFoundationOwnedPlist, launchctlBootstrap, launchdLabel, launchdPlistPath } from '../launch/launchd.ts'
-import { resolveCallerIdentity, resolveIdentity } from '../identity/index.ts'
+import { readPeerProfile, resolveCallerIdentity, resolveIdentity, writePeerProfileAtomic } from '../identity/index.ts'
 import { peerProfilePath } from '../storage/index.ts'
 import {
   isConformant,
@@ -272,6 +272,137 @@ export function startPeer(personality: string, runtime: string | undefined, opts
   return out
 }
 
+export interface AddRuntimeOutcome {
+  personality: string
+  action: 'added' | 'already' | 'skipped-infra-peer' | 'failed'
+  detail?: string
+}
+
+/**
+ * add-runtime <runtime> (--peer <p> | --all) — give EXISTING peers an additional
+ * AGENTIC runtime in one command (codex-parity audit, директива Артура 12.06: the
+ * fleet-switch enabler — 14/23 peers were claude-only with nothing to switch to).
+ * Per target: initPeer({cwd, runtime}) — ensurePeerProfile MERGES runtimes (the
+ * default_runtime lever is deliberately untouched — capability ≠ routing flip; see
+ * `default-runtime`), scaffolds the runtime scope, and the codex side runs its
+ * whole birth chain: cwd pre-trust, native-memory lever, memory provision
+ * (occasion=birth), host-wide MCP block + update-check-off. Idempotent by
+ * construction (merge + append-if-absent everywhere). Infra PEERS (telegram/
+ * notifier defaults) are skipped — adding an agentic runtime to a router peer is
+ * an operator decision, not a sweep.
+ */
+export async function addRuntime(
+  runtime: string,
+  opts: CliEnvOptions & { peer?: string; all?: boolean },
+): Promise<AddRuntimeOutcome[]> {
+  const env = opts.env ?? process.env
+  if (!isRuntime(runtime)) throw new Error(`invalid runtime "${runtime}"`)
+  if (isInfraRuntime(runtime)) {
+    throw new Error(`"${runtime}" is an infra runtime — infra presence is operator-add via \`iapeer create\` (plist semantics), not a sweep`)
+  }
+  const index = readPeersIndex({ env })
+  const targets = opts.all === true ? index.peers : index.peers.filter(p => p.personality === opts.peer)
+  if (targets.length === 0) throw new Error(opts.peer ? `peer "${opts.peer}" is not registered` : 'no targets — pass --peer <p> or --all')
+  // CROSS-PEER operation: strip the CALLER's identity env (PEER_*) — an operator
+  // (or an agent peer) running this from inside their own session would otherwise
+  // poison the TARGET's ensurePeerProfile identity check (live-caught on the very
+  // first 0.2.45 probe: PEER_PERSONALITY="iapeer" vs target "twpar" → failed).
+  const cleanEnv: NodeJS.ProcessEnv = { ...env }
+  delete cleanEnv.PEER_PERSONALITY
+  delete cleanEnv.PEER_RUNTIME
+  delete cleanEnv.PEER_IDENTITY
+  const { initPeer } = await import('../init/index.ts')
+  const out: AddRuntimeOutcome[] = []
+  for (const p of targets) {
+    if (isInfraRuntime(p.runtime)) {
+      out.push({ personality: p.personality, action: 'skipped-infra-peer', detail: `default runtime "${p.runtime}" is infra` })
+      continue
+    }
+    if (p.runtimes.includes(runtime as Runtime)) {
+      out.push({ personality: p.personality, action: 'already' })
+      continue
+    }
+    try {
+      const warns: string[] = []
+      await initPeer({ cwd: p.cwd, runtime: runtime as Runtime, env: cleanEnv, warn: m => warns.push(m) })
+      out.push({ personality: p.personality, action: 'added', detail: warns.length ? warns.join(' | ') : undefined })
+    } catch (e) {
+      out.push({ personality: p.personality, action: 'failed', detail: e instanceof Error ? e.message : String(e) })
+    }
+  }
+  // Self-heal the registry from the locals: provisionPeer's upsert sets the record's
+  // default to the PROVISIONED runtime («args.runtime wins» — right for births, wrong
+  // here: add-runtime is capability-only and must NOT flip routing). The reindex
+  // REPLACE projection restores the local profile's untouched default (live-caught
+  // on the 0.2.45 probe: registry default flipped to codex while the local kept claude).
+  if (out.some(o => o.action === 'added')) await reindexFromLocals({ env })
+  return out
+}
+
+export interface DefaultRuntimeOutcome {
+  personality: string
+  action: 'flipped' | 'already' | 'refused-undeclared-runtime' | 'skipped-infra-peer' | 'failed'
+  detail?: string
+}
+
+/**
+ * default-runtime <runtime> (--peer <p> | --all) — flip the PRIMARY lever
+ * (contract Идентичность: primary держит default_runtime, НЕ порядок runtimes[];
+ * linus precedent 11.06). This is the routing/wake/first-launch default — the
+ * actual fleet-switch moment is a mass flip of exactly this field. The local
+ * profile is rewritten through the H1 merge-writer (default_runtime + the legacy
+ * in-sync mirror; normalizeRuntimes re-prepends the new default), then the
+ * registry is self-healed from the flipped locals (the reindex REPLACE rail —
+ * same as `verify --fix`), so routing flips in the same command. REFUSES a peer
+ * that does not declare the runtime (add-runtime first) and skips infra peers.
+ * Symmetric back: `default-runtime claude --all` reverts the fleet.
+ */
+export async function defaultRuntime(
+  runtime: string,
+  opts: CliEnvOptions & { peer?: string; all?: boolean },
+): Promise<DefaultRuntimeOutcome[]> {
+  const env = opts.env ?? process.env
+  if (!isRuntime(runtime)) throw new Error(`invalid runtime "${runtime}"`)
+  if (isInfraRuntime(runtime)) throw new Error(`"${runtime}" is an infra runtime — not a warm routing default`)
+  const index = readPeersIndex({ env })
+  const targets = opts.all === true ? index.peers : index.peers.filter(p => p.personality === opts.peer)
+  if (targets.length === 0) throw new Error(opts.peer ? `peer "${opts.peer}" is not registered` : 'no targets — pass --peer <p> or --all')
+  const out: DefaultRuntimeOutcome[] = []
+  for (const p of targets) {
+    if (isInfraRuntime(p.runtime)) {
+      out.push({ personality: p.personality, action: 'skipped-infra-peer', detail: `default runtime "${p.runtime}" is infra` })
+      continue
+    }
+    try {
+      const profile = readPeerProfile(p.cwd)
+      if (!profile) {
+        out.push({ personality: p.personality, action: 'failed', detail: `no local profile at ${p.cwd}` })
+        continue
+      }
+      if (profile.runtime === runtime) {
+        out.push({ personality: p.personality, action: 'already' })
+        continue
+      }
+      if (!profile.runtimes.includes(runtime as Runtime)) {
+        out.push({
+          personality: p.personality,
+          action: 'refused-undeclared-runtime',
+          detail: `declares [${profile.runtimes.join(', ')}] — run \`iapeer add-runtime ${runtime} --peer ${p.personality}\` first`,
+        })
+        continue
+      }
+      writePeerProfileAtomic(p.cwd, { ...profile, runtime: runtime as Runtime })
+      out.push({ personality: p.personality, action: 'flipped' })
+    } catch (e) {
+      out.push({ personality: p.personality, action: 'failed', detail: e instanceof Error ? e.message : String(e) })
+    }
+  }
+  // Self-heal the registry from the flipped locals so routing flips in the same
+  // command (REPLACE projection — the verify --fix rail).
+  if (out.some(o => o.action === 'flipped')) await reindexFromLocals({ env })
+  return out
+}
+
 export interface NewPeerOutcome {
   personality: string
   runtime: string
@@ -653,6 +784,8 @@ const USAGE = `usage: iapeer <verb> [args]
   connect telegram <peer> [--token <t>]                          attach a telegram bot to a peer (bot add → interface → router restart; asks only the token)
   enable <plugin> [peer] [--no-setup]                            install + enable an agfpd capability for a peer
   new <peer> [runtime]                                           UNCONDITIONAL fresh restart: canary-clean kill + fresh wake (emergency lever for a hung/dead session — bypasses the peer; exit 0 = fresh session up+ready)
+  add-runtime <runtime> (--peer <p> | --all)                     add an agentic runtime to existing peer(s): runtimes-merge + scaffold + codex birth chain (pre-trust, native-memory, memory provision, MCP). default_runtime untouched
+  default-runtime <runtime> (--peer <p> | --all)                 flip the PRIMARY (routing/wake default) — the fleet-switch lever; refuses an undeclared runtime; registry self-healed in the same command
   attach <peer> [runtime]                                        ensure-live + resume, then tmux attach
   interrupt <peer> [runtime]                                     interrupt the current turn (Escape) — context intact
   compact <peer> [runtime]                                       compact the peer's context (/compact)
@@ -1036,6 +1169,27 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         for (const o of outcomes) out(`${o.personality} (${o.runtime}): ${o.action}${o.reason ? ` — ${o.reason}` : ''}\n`)
         return outcomes.some(o => o.action === 'refused-foreign-launchd') ? 1 : 0
       }
+      case 'add-runtime': {
+        // Fleet-switch enabler (codex-parity audit): add an agentic runtime to
+        // existing peer(s) — full codex birth chain per target, idempotent.
+        const rt = positionals[0]
+        if (!rt) return usage(errOut)
+        const peerName = typeof flags.peer === 'string' ? flags.peer : undefined
+        if (flags.all !== true && !peerName) return usage(errOut)
+        const outcomes = await addRuntime(rt, { peer: peerName, all: flags.all === true, env })
+        for (const o of outcomes) out(`${o.personality}: ${o.action}${o.detail ? ` — ${o.detail}` : ''}\n`)
+        return outcomes.some(o => o.action === 'failed') ? 1 : 0
+      }
+      case 'default-runtime': {
+        // The PRIMARY flip (routing/wake default) — the fleet-switch moment itself.
+        const rt = positionals[0]
+        if (!rt) return usage(errOut)
+        const peerName = typeof flags.peer === 'string' ? flags.peer : undefined
+        if (flags.all !== true && !peerName) return usage(errOut)
+        const outcomes = await defaultRuntime(rt, { peer: peerName, all: flags.all === true, env })
+        for (const o of outcomes) out(`${o.personality}: ${o.action}${o.detail ? ` — ${o.detail}` : ''}\n`)
+        return outcomes.some(o => o.action === 'failed') ? 1 : 0
+      }
       case 'new': {
         // UNCONDITIONAL fresh restart (control, system class — docs/Control-команды
         // §new): the emergency lever for a hung/dead session, bypasses the peer.