@agfpd/iapeer 0.2.70 → 0.2.72

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.70",
+  "version": "0.2.72",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/launch/index.ts

@@ -256,10 +256,14 @@ export const launch: LaunchFn = async (
   // read off the pane-log model (the supervisor's boot-driver answers startup dialogs internally);
   // delivery goes over the supervisor socket. UNCONDITIONAL SPAWN-FALLBACK: any host-bringup failure
   // falls through to the tmux path below — a flipped peer is NEVER worse than tmux ON SPAWN. Flag-off →
-  // this whole block is skipped and the tmux path is byte-identical (golden). Routers are never hosted
-  // (infra, launchd-owned). @xterm stays out of THIS process (ptyHost: @xterm-free start + deliver +
-  // sessionAlive; readiness's @xterm import is dynamic and only loads here, flag-on).
-  if (adapter.kind === 'tui' && ptyHostEnabled(cfg.logDir, identity)) {
+  // this whole block is skipped and the tmux path is byte-identical (golden). Routers (telegram/
+  // notifier) are ALSO hostable flag-on (cutover infra-track): launchd STILL owns their lifecycle via
+  // run-infra (H4) — the supervisor only provides the pty + delivery socket + pane-log; the router
+  // branch below skips every TUI phase (no boot dialogs — BOOT_ADAPTERS has no router entry so the
+  // supervisor's boot-driver is skipped; no transcript ready-gate — newestActivityMtime=null). @xterm
+  // stays out of THIS process (ptyHost: @xterm-free start + deliver + sessionAlive; readiness's @xterm
+  // import is dynamic and only loads here, flag-on — and the router branch never reaches it).
+  if ((adapter.kind === 'tui' || adapter.kind === 'router') && ptyHostEnabled(cfg.logDir, identity)) {
     const invocation = buildLaunchInvocation(spec, adapter, cfg)
     mkdirSync(cfg.logDir, { recursive: true, mode: 0o700 }) // the supervisor writes the pane-log here
     const paneLogPath = `${cfg.logDir}/${identity}.log`
@@ -272,6 +276,17 @@ export const launch: LaunchFn = async (
       invocation,
     })
     if (host.ok) {
+      // ROUTER (telegram/notifier): no startup dialogs and no transcript. The session is "up" the
+      // instant the supervisor child is serving — symmetric to the tmux router path, where launch
+      // returns READY the moment `tmux new-session` succeeds and the always-on caller (runAlwaysOn)
+      // does its own BOOT_RECHECK to catch an immediate child-death. Always-on routers launch with an
+      // EMPTY firstMessage; deliveries arrive LATER over the socket (deliverHosted → child stdin → the
+      // router's <iap>-marker stdin reader). So confirm the hosted session is live and return ready —
+      // no waitHostReady (would load @xterm for nothing), no first-message deliver, no ready-gate.
+      if (adapter.kind === 'router') {
+        if (hostSessionAlive(identity)) return ready(identity)
+        return fail(identity, 'hosted router session not alive immediately after bringup')
+      }
       // BOOT: the supervisor's boot-driver dismisses startup dialogs internally; wait for the input
       // surface via the pane-log model, then deliver over the socket + ready-gate on a model turn —
       // the SAME shape as the tmux boot/deliver/ready-gate below, with host equivalents.

package/src/launch/launchdRun.ts

@@ -23,6 +23,7 @@ import { buildProcessAddress, buildSocketPath } from '../core/socket.ts'
 import { peerLogsDir, pluginLogsDir } from '../storage/index.ts'
 import { readPeerProfile } from '../identity/index.ts'
 import { getAdapter, launch } from './index.ts'
+import { hostSessionAlive, killPtyHost } from './ptyHost.ts'
 import { dismissCanary, signalCanaryClean } from './canary.ts'
 import type { LaunchConfig, LaunchSpec } from './types.ts'
 
@@ -115,6 +116,14 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   const sock = buildSocketPath(runtime, personality, sockDir)
   const adapter = getAdapter(runtime)
 
+  // Host-aware liveness (cutover infra-track): a flag-on router is supervisor-HOSTED (no tmux session);
+  // a flag-off one is tmux. Probe BOTH backings by RUNTIME STATE (not the `.pty-host` marker), so this
+  // is robust to a spawn-FALLBACK — if startPtyHost failed and launch fell back to tmux, the marker is
+  // present yet the live session is tmux. The router is "up" iff EITHER backing is alive; on child
+  // death BOTH go false → block-watch exits → run-infra exits → launchd KeepAlive respawns (the SOLE
+  // respawn owner; the supervisor never self-respawns — H4 held).
+  const isAlive = (): boolean => hostSessionAlive(identity) || sessionAlive(sock, identity)
+
   const cfg: LaunchConfig = {
     claudeBin: env.CLAUDE_BIN ?? 'claude',
     codexBin: env.CODEX_BIN ?? 'codex',
@@ -143,7 +152,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   const spec = buildAlwaysOnSpec(personality, runtime, cwd, sockDir)
 
   // Idempotent: bring up only when not already live.
-  if (!sessionAlive(sock, identity)) {
+  if (!isAlive()) {
     const result = await launch(spec, adapter, '', cfg)
     if (result.status !== 'READY') {
       process.stderr.write(`launchdRun: launch FAILED for ${identity}: ${result.reason ?? 'unknown'}\n`)
@@ -155,7 +164,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
     // (a diagnostic, throttled by the plist) instead of a clean exit that reads as a
     // healthy run in the launchd logs.
     await sleep(BOOT_RECHECK_MS)
-    if (!sessionAlive(sock, identity)) {
+    if (!isAlive()) {
       process.stderr.write(
         `launchdRun: ${identity} session died immediately after launch — check ${cfg.notifierBin ?? `${runtime}-runtime`}\n`,
       )
@@ -175,7 +184,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   }
   process.on('SIGTERM', onSignal)
   process.on('SIGINT', onSignal)
-  while (!stop && sessionAlive(sock, identity)) {
+  while (!stop && isAlive()) {
     await new Promise<void>(resolve => {
       const timer = setTimeout(resolve, WATCH_INTERVAL_MS)
       interrupt = () => {
@@ -190,7 +199,14 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   // holding stale in-memory state (см. teardownAlwaysOnSession). A natural session
   // death (stop=false) skips this: there is nothing to tear down, exit 0 →
   // KeepAlive respawns a fresh bring-up.
-  if (stop) teardownAlwaysOnSession(sock, identity)
+  // Signal-initiated stop (bootout / shutdown / kickstart -k) tears the session down WITH this watcher.
+  // A hosted router → kill the supervisor daemon (killPtyHost: SIGTERM → it SIGKILLs the child + cleans
+  // up); a tmux router → the tmux teardown. Pick by the live backing. A NATURAL death (stop=false) skips
+  // this: nothing to tear down, exit 0 → KeepAlive respawns a fresh bring-up.
+  if (stop) {
+    if (hostSessionAlive(identity)) killPtyHost(identity)
+    else teardownAlwaysOnSession(sock, identity)
+  }
   return 0
 }
 

package/src/supervisor/daemon.test.ts

@@ -174,4 +174,40 @@ d('supervisor daemon (Bun-native pty, tick runtime)', () => {
       }
     }
   })
+
+  // FINDING-2 — restore the SERVE geometry on last detach. The daemon resizes the child pty to a
+  // client's size on attach and (before this) never restored it, so an unattached session stuck at a
+  // departed client's size → the fixed-geometry warm-deliver/ready-gate viewport model mismatched the
+  // pty. Drive it with a child that prints its live pty winsize ("ROWS COLS") to the pane-log: attach
+  // small → pty shrinks; detach → pty restores to the serve geometry.
+  test('FINDING-2: last detach restores the serve geometry (no sticking at the client size)', async () => {
+    const gSession = 'ptsgeo'
+    const paneLog = join(runDir, 'geo-pane.log')
+    const lastSize = (): string => {
+      const t = existsSync(paneLog) ? readFileSync(paneLog, 'utf8') : ''
+      const m = [...t.matchAll(/(\d+) (\d+)/g)]
+      return m.length ? `${m[m.length - 1][1]}x${m[m.length - 1][2]}` : ''
+    }
+    try {
+      const r = startSupervisorDaemon({
+        session: gSession,
+        runtime: 'tick',
+        runDir,
+        // serve geometry 200x50 (distinct from defaults); child reports its live pty winsize as "rows cols"
+        serve: { argv: ['sh', '-c', 'while :; do stty size 2>/dev/null; sleep 0.3; done'], env: { PATH: process.env.PATH ?? '' }, cwd: runDir, paneLogPath: paneLog, cols: 200, rows: 50 },
+      })
+      expect(r.state).toBe('started')
+      expect(await waitFor(() => lastSize() === '50 200'.replace(' ', 'x'), 6000)).toBe(true) // at serve geometry
+      const c = await attach(runDir, gSession, 90, 30) // attach at a DIFFERENT size → pty resizes to it
+      expect(await waitFor(() => lastSize() === '30x90', 6000)).toBe(true) // pty shrank to the client size
+      c.close() // last client gone
+      expect(await waitFor(() => lastSize() === '50x200', 6000)).toBe(true) // RESTORED to serve geometry
+    } finally {
+      try {
+        killSession(runDir, gSession)
+      } catch {
+        /* */
+      }
+    }
+  })
 })

package/src/supervisor/daemon.ts

@@ -90,6 +90,13 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
   const { session, runtime, runDir } = opts
   let cols = opts.cols ?? 80
   let rows = opts.rows ?? 30
+  // The SERVE geometry — the size the session is hosted at (HOST_COLS×HOST_ROWS for a pty-host peer),
+  // immutable. `cols`/`rows` above track the CURRENT (client-driven) size. A client attaches at its own
+  // terminal size and the pty resizes to match; on LAST detach we restore the serve geometry (below) so
+  // the unattached session never sticks at a departed client's size — otherwise the warm-deliver /
+  // ready-gate viewport model (built at the fixed serve geometry) mismatches the actually-resized pty.
+  const serveCols = cols
+  const serveRows = rows
   const sock = sockPath(runDir, session)
   const pid = pidPath(runDir, session)
 
@@ -217,28 +224,40 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
     sendClient(s, frame(FRAME_DATA, Buffer.from(snap, 'utf8')))
   }
 
+  // Resize the model + child pty to (c, r). Shared by client FRAME_RESIZE and the last-detach restore.
+  const applyGeometry = (c: number, r: number): void => {
+    cols = c
+    rows = r
+    try {
+      xterm.resize(c, r)
+      child.terminal.resize(c, r)
+    } catch {
+      /* transient */
+    }
+    // Best-effort SIGWINCH nudge for a SIGWINCH-reactive child (forces a repaint at the new size); NOT
+    // load-bearing for an attached client (the complete snapshot repaint is), but for the unattached
+    // restore it is what makes the child redraw into the pane-log at the serve geometry.
+    try {
+      child.terminal.resize(c, Math.max(1, r - 1))
+      child.terminal.resize(c, r)
+    } catch {
+      /* */
+    }
+  }
+  // Restore the serve geometry when the last client detaches, so the unattached session never sticks at
+  // a departed client's size (FINDING-2 — would mismatch the fixed-geometry warm-deliver/ready-gate
+  // viewport model). No-op when already at serve geometry or a client is still attached.
+  const restoreServeGeometryIfIdle = (): void => {
+    if (clients.size === 0 && (cols !== serveCols || rows !== serveRows)) applyGeometry(serveCols, serveRows)
+  }
+
   const onClientFrame = (s: { write(b: Buffer): number }, type: number, payload: Buffer): void => {
     if (type === FRAME_DATA) {
       child.terminal.write(payload) // keystrokes → child
     } else if (type === FRAME_RESIZE) {
       const sz = parseSize(payload)
-      cols = sz.cols
-      rows = sz.rows
-      try {
-        xterm.resize(cols, rows)
-        child.terminal.resize(cols, rows)
-      } catch {
-        /* transient */
-      }
+      applyGeometry(sz.cols, sz.rows)
       repaint(s) // instant paint from the snapshot (delivered COMPLETE via backpressure)
-      // Best-effort SIGWINCH nudge for a SIGWINCH-reactive child; NOT load-bearing (the complete
-      // snapshot above is the real freshness fix).
-      try {
-        child.terminal.resize(cols, Math.max(1, rows - 1))
-        child.terminal.resize(cols, rows)
-      } catch {
-        /* */
-      }
     }
   }
 
@@ -266,11 +285,13 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
         clients.delete(s)
         writers.delete(s)
         syncAttached()
+        restoreServeGeometryIfIdle() // last client gone → un-stick the pty from its size
       },
       error(s: object) {
         clients.delete(s)
         writers.delete(s)
         syncAttached()
+        restoreServeGeometryIfIdle()
       },
     },
   })

package/src/transport/hostDeliver.test.ts

@@ -100,3 +100,38 @@ describe('deliverWarm — hosted target delivers over the socket + confirms by t
     expect(mtimeProbes).toBe(0) // no cwd → the transcript proxy is never consulted
   })
 })
+
+// Cutover infra-track — a hosted ROUTER (telegram/notifier) has NO transcript proxy
+// (adapter.newestActivityMtime=null), so the mtime-advance confirm a TUI uses can never be satisfied
+// and would false-FAIL every router delivery. The host path confirms a router by the socket-ack —
+// PARITY with deliverViaTmux's router C-j path (delivery-level confirm; router liveness is structural
+// via launchd, not a model turn). These cases pin that behavior.
+const routerTarget: DeliveryTarget = {
+  runtime: 'notifier', // notifierAdapter.kind === 'router'
+  personality: 'timer',
+  address: 'notifier-timer',
+  socketPath: '/tmp/nonexistent-iap-test.sock',
+}
+
+describe('deliverWarm — hosted ROUTER confirms by socket-ack (no transcript proxy)', () => {
+  test('router deliver ok → ok EVEN THOUGH mtime never advances (the exact scenario a TUI fails on)', async () => {
+    process.env.IAP_HOST_LIVENESS_GRACE_MS = '0' // a mtime-gated path would fail at once here
+    const seam: WarmDeliverSeam = {
+      hostAlive: () => true,
+      deliverHosted: async () => ({ ok: true }),
+      newestActivityMtime: () => 100, // constant — a router writes no transcript; a TUI here → loud fail
+    }
+    const r = await deliverWarm(routerTarget, '<iap>x</iap>', '/peer/cwd', seam)
+    expect(r.ok).toBe(true) // socket-ack IS the confirm for a router; the non-advancing transcript is irrelevant
+  })
+
+  test('router socket deliver fails (dead/stalled) → loud fail, no false ok', async () => {
+    const seam: WarmDeliverSeam = {
+      hostAlive: () => true,
+      deliverHosted: async () => ({ ok: false, error: 'socket dead during paste' }),
+    }
+    const r = await deliverWarm(routerTarget, '<iap>x</iap>', '/peer/cwd', seam)
+    expect(r.ok).toBe(false)
+    if (!r.ok) expect(r.error.message).toContain('deliver failed')
+  })
+})

package/src/transport/index.ts

@@ -564,6 +564,13 @@ async function deliverViaHost(
         `message NOT delivered`,
     )
   }
+  // Router (telegram/notifier): no transcript proxy (adapter.newestActivityMtime=null) → the
+  // mtime-advance confirm below can NEVER be satisfied and would false-FAIL every router delivery.
+  // Confirm by the socket-ack just obtained — PARITY with deliverViaTmux's router path (C-j success =
+  // delivery-level confirm; a router's liveness is structural via launchd KeepAlive, not a model
+  // turn). See deliverViaTmux router branch (paste-buffer -r + C-j, no transcript confirm) + its
+  // header note "router … liveness is structural".
+  if (adapter.kind === 'router') return ok(undefined)
   // socket-ack ≠ landed. With no activity proxy (direct callers/tests without a cwd) we can only
   // trust the flushed submit — confirmed-only, mirroring deliverViaTmux's legacy-caller path.
   if (!cwd) return ok(undefined)