@agfpd/iapeer 0.2.54 → 0.2.56

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.54",
+  "version": "0.2.56",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/daemon/daemon.test.ts

@@ -77,7 +77,12 @@ describe('listTools', () => {
     const tools = listTools(readPeersIndex()) as any[]
     expect(tools.map(t => t.name).sort()).toEqual(['send_to_peer'])
     expect(tools.every(t => t._meta['anthropic/alwaysLoad'] === true)).toBe(true)
-    expect(tools.find(t => t.name === 'send_to_peer').description).toContain('arthur')
+    const sendTool = tools.find(t => t.name === 'send_to_peer')
+    expect(sendTool.description).toContain('arthur')
+    expect(sendTool.description).toContain('wakes it and delivers there')
+    expect(sendTool.description).toContain('parallel to the default runtime')
+    expect(sendTool.inputSchema.properties.runtime.description).toContain('wakes it warm-on-demand')
+    expect(sendTool.inputSchema.properties.runtime.description).toContain('parallel session')
   })
 })
 

package/src/daemon/index.ts

@@ -98,7 +98,7 @@ export function buildSendDescription(index: PeersIndex): string {
   }
   lines.push(
     '',
-    "Use `personality`, not a runtime-prefixed identity. Set `runtime` only for a current-send override. Descriptions identify the peer's role; runtimes identify reachable delivery endpoints; intelligence identifies the nature of the peer (artificial / natural / absent). Inbound peer messages arrive as <iap from-personality=\"...\" from-runtime=\"...\" from-intelligence=\"...\"> blocks. The topic attribute is optional.",
+    "Use `personality`, not a runtime-prefixed identity. Set `runtime` to target a specific declared runtime for this send. If that runtime is warm-asleep, the daemon wakes it and delivers there; use this to intentionally bring up a second session of the same peer in parallel to the default runtime (for example codex alongside claude). Descriptions identify the peer's role; runtimes identify reachable delivery endpoints; intelligence identifies the nature of the peer (artificial / natural / absent). Inbound peer messages arrive as <iap from-personality=\"...\" from-runtime=\"...\" from-intelligence=\"...\"> blocks. The topic attribute is optional.",
   )
   return lines.join('\n')
 }
@@ -122,7 +122,7 @@ export function listTools(index: PeersIndex): unknown[] {
           runtime: {
             type: 'string',
             description:
-              'Optional delivery runtime override for this send. Runtime ids are short channel names such as claude, codex, telegram.',
+              'Optional target runtime for this send. If the specified runtime is declared and wakeable but asleep, the daemon wakes it warm-on-demand and delivers there; choosing a non-default runtime can intentionally start that peer\'s parallel session. Runtime ids are short channel names such as claude, codex, telegram.',
             pattern: RUNTIME_RE_SOURCE,
           },
           message: {

package/src/launch/bootdeliver.test.ts

@@ -87,7 +87,6 @@ describe('boot first-message delivery (load-buffer + bracketed paste)', () => {
         sockDir: root,
         bootDeadlineSecs: 10,
         readyGateSecs: 8,
-        maxAgeSecs: 120,
         logDir: join(root, 'logs'),
       }
       try {

package/src/launch/index.ts

@@ -340,14 +340,18 @@ export const launch: LaunchFn = async (
   const paneLog = `${cfg.logDir}/${identity}.log`
   tmux(sock, 'pipe-pane', '-t', identity, `cat >> ${shellQuote(paneLog)}`)
 
-  // (4) Session self-TTL: a tmux server-side timer kills the session at max-age,
-  //     independent of any supervisor (bounds a zombie even if no sweep runs).
-  //     SKIPPED for an always-on (infra) session — launchd KeepAlive owns its
-  //     lifecycle, so a self-kill timer would fight it and tear down the endpoint.
-  if (!cfg.alwaysOn) {
-    tmux(sock, 'run-shell', '-b', '-d', String(cfg.maxAgeSecs),
-      `tmux -S ${shellQuote(sock)} kill-session -t ${shellQuote(identity)}`)
-  }
+  // (4) [REMOVED 0.2.55] Session self-TTL. Was a tmux server-side
+  //     `run-shell -b -d <maxAgeSecs>` → `kill-session`, intended to bound a zombie
+  //     even if no supervise sweep runs. It was a BLIND wall-clock kill armed ONCE
+  //     at birth and never re-armed, so it guillotined HEALTHY long-lived sessions
+  //     at exactly birth+maxAge (4 h) — the recurrent boris/iapeer "mystery deaths".
+  //     By construction any session that survives to maxAge is active: idle ones are
+  //     already idle-reaped at idleSecs (1 h) by the activity-aware supervisor — so
+  //     the blind kill could ONLY ever destroy live work (its sole "useful" case,
+  //     daemon dead the whole interval, leaves an inert orphan nothing can deliver
+  //     to, self-healed by idle-reap on daemon restart). The activity-aware idle-reap
+  //     (superviseTick) is now the SOLE lifecycle bound. See ADR «миграция …» / vault
+  //     note «Четырёхчасовой TTL-backstop …». (alwaysOn infra never armed it.)
 
   // (5) Router runtime (telegram): no TUI input surface — there is no boot dialog
   //     and no ready marker to gate on. The process is up; return READY.

package/src/launch/launch.test.ts

@@ -15,7 +15,6 @@ const launchCfg: LaunchConfig = {
   sockDir: '/tmp',
   bootDeadlineSecs: 1,
   readyGateSecs: 1,
-  maxAgeSecs: 1,
   logDir: '/tmp/iapeer-test-logs',
 }
 function spec(over: Partial<LaunchSpec> = {}): LaunchSpec {

package/src/launch/launchdRun.ts

@@ -125,7 +125,6 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
     sockDir,
     bootDeadlineSecs: 30,
     readyGateSecs: 30,
-    maxAgeSecs: 0, // unused — alwaysOn skips the self-TTL
     // GLOBAL infra logs (Фаза §8): ~/.iapeer/logs/<personality>/ — match the plist's
     // stdout/stderr dir (installAlwaysOnPlist), not per-peer <cwd>/.iapeer/logs/.
     logDir: peerLogsDir(personality, { env }),

package/src/launch/sockdir.test.ts

@@ -47,7 +47,6 @@ describe('launch creates a missing socket dir', () => {
       sockDir,
       bootDeadlineSecs: 1,
       readyGateSecs: 1,
-      maxAgeSecs: 0,
       logDir: join(root, 'logs'),
       alwaysOn: true,
     }

package/src/launch/types.ts

@@ -296,7 +296,6 @@ export interface LaunchConfig extends LaunchAdapterConfig {
   sockDir: string
   bootDeadlineSecs: number
   readyGateSecs: number
-  maxAgeSecs: number
   /** Log dir for pipe-pane output. */
   logDir: string
   /**
@@ -312,10 +311,12 @@ export interface LaunchConfig extends LaunchAdapterConfig {
   exitLogDir?: string
   env?: NodeJS.ProcessEnv
   /**
-   * Always-on bring-up (infra runtimes held by launchd KeepAlive): SKIP the
-   * session self-TTL so the session is not auto-killed at maxAgeSecs. The TTL is
-   * a warm-on-demand zombie bound; an always-on session's lifecycle is owned by
-   * launchd (KeepAlive respawns it), so the self-kill timer must not fire.
+   * Always-on bring-up (infra runtimes held by launchd KeepAlive). Marks the
+   * session as infra-owned: launchd (KeepAlive) owns its lifecycle, the daemon is
+   * READ-ONLY for it (H4), and it opts out of the warm-on-demand `-v` tmux
+   * command-log (a rare-relaunch infra session has no rotation point and is not the
+   * dying warm class). Historically it also skipped the session self-TTL; that TTL
+   * was removed in 0.2.55 (see launch step 4), so the exemption is now moot.
    */
   alwaysOn?: boolean
 }
@@ -329,7 +330,7 @@ export interface LaunchResult {
 
 /**
  * Bring up ONE session: pre-clean stale tmux server → tmux new-session -d with
- * adapter.buildArgv → pipe-pane → session self-TTL → boot (answer dialogs via
+ * adapter.buildArgv → pipe-pane → boot (answer dialogs via
  * adapter, wait for adapter.isInputReady, deliver the first message via
  * load-buffer + bracketed paste — the same byte-path as warm delivery) →
  * ready-gate (adapter.newestActivityMtime strictly advances).

package/src/lifecycle/index.ts

@@ -68,7 +68,6 @@ export interface LifecycleConfig {
   bootDeadlineSecs: number
   readyGateSecs: number
   idleSecs: number
-  maxAgeSecs: number
   /** Crash-loop guard: refuse to (re)launch after this many deaths within the window. */
   crashLoopMax: number
   /** Crash-loop guard: the sliding window (seconds) the death count is measured over. */
@@ -109,7 +108,6 @@ export function loadLifecycleConfig(env: NodeJS.ProcessEnv = process.env): Lifec
     bootDeadlineSecs: num(env.IAPEER_BOOT_DEADLINE_SECS, 240),
     readyGateSecs: num(env.IAPEER_READY_GATE_SECS, 120),
     idleSecs: num(env.IAPEER_IDLE_SECS, 3600),
-    maxAgeSecs: num(env.IAPEER_MAX_AGE_SECS, 14400),
     crashLoopMax: num(env.IAPEER_CRASHLOOP_MAX, 3),
     crashLoopWindowSecs: num(env.IAPEER_CRASHLOOP_WINDOW_SECS, 300),
     ephemeralQuietSecs: num(env.IAPEER_EPHEMERAL_QUIET_SECS, 20),
@@ -988,7 +986,6 @@ export async function wakeOrSpawn(args: WakeArgs, deps: WakeDeps = {}): Promise<
       sockDir: cfg.sockDir,
       bootDeadlineSecs: cfg.bootDeadlineSecs,
       readyGateSecs: cfg.readyGateSecs,
-      maxAgeSecs: cfg.maxAgeSecs,
       logDir: cfg.logDir,
       // Exit-cause log → next to lifecycle.log (~/.iapeer/logs/iapeer), where the
       // investigator already looks: a self-death now leaves `exits.log` with the
@@ -1007,13 +1004,15 @@ export async function wakeOrSpawn(args: WakeArgs, deps: WakeDeps = {}): Promise<
       return { status: 'FAILED', woke: false, runtime, reason: result.reason }
     }
     // The session is up and the message delivered. Recording supervise-state must not
-    // turn a successful wake into a failure (audit #18): on a write hiccup the session is
-    // still bounded by its tmux self-TTL — log loudly rather than throw past a live spawn.
+    // turn a successful wake into a failure (audit #18): log loudly rather than throw
+    // past a live spawn. NB since 0.2.55 (self-TTL removed) the session-state file IS
+    // the only thing that enrolls this session into the activity-aware idle-reap — a
+    // failed write leaves it UNSUPERVISED with no TTL backstop, hence the loud WARN.
     try {
       writeSessionState(cfg, { identity, runtime, personality: args.personality, cwd, wokeAt: Date.now() })
     } catch (e) {
       process.stderr.write(
-        `[iapeer] WARN session-state write failed for ${identity} — session is live + TTL-bounded but not idle-reap-supervised: ${e instanceof Error ? e.message : String(e)}\n`,
+        `[iapeer] WARN session-state write failed for ${identity} — session is live but UNSUPERVISED (not enrolled in idle-reap; self-TTL removed): ${e instanceof Error ? e.message : String(e)}\n`,
       )
     }
     // A NEWLY launched session starts UNARMED by definition (no outbound yet) — clear

package/src/lifecycle/lifecycle.test.ts

@@ -129,7 +129,6 @@ describe('withWakeLock', () => {
       bootDeadlineSecs: 1,
       readyGateSecs: 1,
       idleSecs: 1,
-      maxAgeSecs: 1,
     }) as LifecycleConfig
 
   test('two concurrent locks on the same identity run strictly serialized', async () => {
@@ -194,7 +193,6 @@ describe('superviseTick H4 guard', () => {
       bootDeadlineSecs: 1,
       readyGateSecs: 1,
       idleSecs: 1,
-      maxAgeSecs: 1,
     }) as LifecycleConfig
 
   function writeState(personality: string): string {