@agfpd/iapeer 0.2.71 → 0.2.72

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.71",
+  "version": "0.2.72",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/launch/index.ts

@@ -256,10 +256,14 @@ export const launch: LaunchFn = async (
   // read off the pane-log model (the supervisor's boot-driver answers startup dialogs internally);
   // delivery goes over the supervisor socket. UNCONDITIONAL SPAWN-FALLBACK: any host-bringup failure
   // falls through to the tmux path below — a flipped peer is NEVER worse than tmux ON SPAWN. Flag-off →
-  // this whole block is skipped and the tmux path is byte-identical (golden). Routers are never hosted
-  // (infra, launchd-owned). @xterm stays out of THIS process (ptyHost: @xterm-free start + deliver +
-  // sessionAlive; readiness's @xterm import is dynamic and only loads here, flag-on).
-  if (adapter.kind === 'tui' && ptyHostEnabled(cfg.logDir, identity)) {
+  // this whole block is skipped and the tmux path is byte-identical (golden). Routers (telegram/
+  // notifier) are ALSO hostable flag-on (cutover infra-track): launchd STILL owns their lifecycle via
+  // run-infra (H4) — the supervisor only provides the pty + delivery socket + pane-log; the router
+  // branch below skips every TUI phase (no boot dialogs — BOOT_ADAPTERS has no router entry so the
+  // supervisor's boot-driver is skipped; no transcript ready-gate — newestActivityMtime=null). @xterm
+  // stays out of THIS process (ptyHost: @xterm-free start + deliver + sessionAlive; readiness's @xterm
+  // import is dynamic and only loads here, flag-on — and the router branch never reaches it).
+  if ((adapter.kind === 'tui' || adapter.kind === 'router') && ptyHostEnabled(cfg.logDir, identity)) {
     const invocation = buildLaunchInvocation(spec, adapter, cfg)
     mkdirSync(cfg.logDir, { recursive: true, mode: 0o700 }) // the supervisor writes the pane-log here
     const paneLogPath = `${cfg.logDir}/${identity}.log`
@@ -272,6 +276,17 @@ export const launch: LaunchFn = async (
       invocation,
     })
     if (host.ok) {
+      // ROUTER (telegram/notifier): no startup dialogs and no transcript. The session is "up" the
+      // instant the supervisor child is serving — symmetric to the tmux router path, where launch
+      // returns READY the moment `tmux new-session` succeeds and the always-on caller (runAlwaysOn)
+      // does its own BOOT_RECHECK to catch an immediate child-death. Always-on routers launch with an
+      // EMPTY firstMessage; deliveries arrive LATER over the socket (deliverHosted → child stdin → the
+      // router's <iap>-marker stdin reader). So confirm the hosted session is live and return ready —
+      // no waitHostReady (would load @xterm for nothing), no first-message deliver, no ready-gate.
+      if (adapter.kind === 'router') {
+        if (hostSessionAlive(identity)) return ready(identity)
+        return fail(identity, 'hosted router session not alive immediately after bringup')
+      }
       // BOOT: the supervisor's boot-driver dismisses startup dialogs internally; wait for the input
       // surface via the pane-log model, then deliver over the socket + ready-gate on a model turn —
       // the SAME shape as the tmux boot/deliver/ready-gate below, with host equivalents.

package/src/launch/launchdRun.ts

@@ -23,6 +23,7 @@ import { buildProcessAddress, buildSocketPath } from '../core/socket.ts'
 import { peerLogsDir, pluginLogsDir } from '../storage/index.ts'
 import { readPeerProfile } from '../identity/index.ts'
 import { getAdapter, launch } from './index.ts'
+import { hostSessionAlive, killPtyHost } from './ptyHost.ts'
 import { dismissCanary, signalCanaryClean } from './canary.ts'
 import type { LaunchConfig, LaunchSpec } from './types.ts'
 
@@ -115,6 +116,14 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   const sock = buildSocketPath(runtime, personality, sockDir)
   const adapter = getAdapter(runtime)
 
+  // Host-aware liveness (cutover infra-track): a flag-on router is supervisor-HOSTED (no tmux session);
+  // a flag-off one is tmux. Probe BOTH backings by RUNTIME STATE (not the `.pty-host` marker), so this
+  // is robust to a spawn-FALLBACK — if startPtyHost failed and launch fell back to tmux, the marker is
+  // present yet the live session is tmux. The router is "up" iff EITHER backing is alive; on child
+  // death BOTH go false → block-watch exits → run-infra exits → launchd KeepAlive respawns (the SOLE
+  // respawn owner; the supervisor never self-respawns — H4 held).
+  const isAlive = (): boolean => hostSessionAlive(identity) || sessionAlive(sock, identity)
+
   const cfg: LaunchConfig = {
     claudeBin: env.CLAUDE_BIN ?? 'claude',
     codexBin: env.CODEX_BIN ?? 'codex',
@@ -143,7 +152,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   const spec = buildAlwaysOnSpec(personality, runtime, cwd, sockDir)
 
   // Idempotent: bring up only when not already live.
-  if (!sessionAlive(sock, identity)) {
+  if (!isAlive()) {
     const result = await launch(spec, adapter, '', cfg)
     if (result.status !== 'READY') {
       process.stderr.write(`launchdRun: launch FAILED for ${identity}: ${result.reason ?? 'unknown'}\n`)
@@ -155,7 +164,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
     // (a diagnostic, throttled by the plist) instead of a clean exit that reads as a
     // healthy run in the launchd logs.
     await sleep(BOOT_RECHECK_MS)
-    if (!sessionAlive(sock, identity)) {
+    if (!isAlive()) {
       process.stderr.write(
         `launchdRun: ${identity} session died immediately after launch — check ${cfg.notifierBin ?? `${runtime}-runtime`}\n`,
       )
@@ -175,7 +184,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   }
   process.on('SIGTERM', onSignal)
   process.on('SIGINT', onSignal)
-  while (!stop && sessionAlive(sock, identity)) {
+  while (!stop && isAlive()) {
     await new Promise<void>(resolve => {
       const timer = setTimeout(resolve, WATCH_INTERVAL_MS)
       interrupt = () => {
@@ -190,7 +199,14 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   // holding stale in-memory state (см. teardownAlwaysOnSession). A natural session
   // death (stop=false) skips this: there is nothing to tear down, exit 0 →
   // KeepAlive respawns a fresh bring-up.
-  if (stop) teardownAlwaysOnSession(sock, identity)
+  // Signal-initiated stop (bootout / shutdown / kickstart -k) tears the session down WITH this watcher.
+  // A hosted router → kill the supervisor daemon (killPtyHost: SIGTERM → it SIGKILLs the child + cleans
+  // up); a tmux router → the tmux teardown. Pick by the live backing. A NATURAL death (stop=false) skips
+  // this: nothing to tear down, exit 0 → KeepAlive respawns a fresh bring-up.
+  if (stop) {
+    if (hostSessionAlive(identity)) killPtyHost(identity)
+    else teardownAlwaysOnSession(sock, identity)
+  }
   return 0
 }
 

package/src/transport/hostDeliver.test.ts

@@ -100,3 +100,38 @@ describe('deliverWarm — hosted target delivers over the socket + confirms by t
     expect(mtimeProbes).toBe(0) // no cwd → the transcript proxy is never consulted
   })
 })
+
+// Cutover infra-track — a hosted ROUTER (telegram/notifier) has NO transcript proxy
+// (adapter.newestActivityMtime=null), so the mtime-advance confirm a TUI uses can never be satisfied
+// and would false-FAIL every router delivery. The host path confirms a router by the socket-ack —
+// PARITY with deliverViaTmux's router C-j path (delivery-level confirm; router liveness is structural
+// via launchd, not a model turn). These cases pin that behavior.
+const routerTarget: DeliveryTarget = {
+  runtime: 'notifier', // notifierAdapter.kind === 'router'
+  personality: 'timer',
+  address: 'notifier-timer',
+  socketPath: '/tmp/nonexistent-iap-test.sock',
+}
+
+describe('deliverWarm — hosted ROUTER confirms by socket-ack (no transcript proxy)', () => {
+  test('router deliver ok → ok EVEN THOUGH mtime never advances (the exact scenario a TUI fails on)', async () => {
+    process.env.IAP_HOST_LIVENESS_GRACE_MS = '0' // a mtime-gated path would fail at once here
+    const seam: WarmDeliverSeam = {
+      hostAlive: () => true,
+      deliverHosted: async () => ({ ok: true }),
+      newestActivityMtime: () => 100, // constant — a router writes no transcript; a TUI here → loud fail
+    }
+    const r = await deliverWarm(routerTarget, '<iap>x</iap>', '/peer/cwd', seam)
+    expect(r.ok).toBe(true) // socket-ack IS the confirm for a router; the non-advancing transcript is irrelevant
+  })
+
+  test('router socket deliver fails (dead/stalled) → loud fail, no false ok', async () => {
+    const seam: WarmDeliverSeam = {
+      hostAlive: () => true,
+      deliverHosted: async () => ({ ok: false, error: 'socket dead during paste' }),
+    }
+    const r = await deliverWarm(routerTarget, '<iap>x</iap>', '/peer/cwd', seam)
+    expect(r.ok).toBe(false)
+    if (!r.ok) expect(r.error.message).toContain('deliver failed')
+  })
+})

package/src/transport/index.ts

@@ -564,6 +564,13 @@ async function deliverViaHost(
         `message NOT delivered`,
     )
   }
+  // Router (telegram/notifier): no transcript proxy (adapter.newestActivityMtime=null) → the
+  // mtime-advance confirm below can NEVER be satisfied and would false-FAIL every router delivery.
+  // Confirm by the socket-ack just obtained — PARITY with deliverViaTmux's router path (C-j success =
+  // delivery-level confirm; a router's liveness is structural via launchd KeepAlive, not a model
+  // turn). See deliverViaTmux router branch (paste-buffer -r + C-j, no transcript confirm) + its
+  // header note "router … liveness is structural".
+  if (adapter.kind === 'router') return ok(undefined)
   // socket-ack ≠ landed. With no activity proxy (direct callers/tests without a cwd) we can only
   // trust the flushed submit — confirmed-only, mirroring deliverViaTmux's legacy-caller path.
   if (!cwd) return ok(undefined)