@agfpd/iapeer 0.2.71 → 0.2.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.71",
+  "version": "0.2.73",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/launch/bootdeliver.test.ts

@@ -12,7 +12,7 @@
 // key-by-key retype), not the tty discipline.
 
 import { afterEach, describe, expect, test } from 'bun:test'
-import { mkdtempSync, readFileSync, rmSync, statSync } from 'fs'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'fs'
 import { tmpdir } from 'os'
 import { join } from 'path'
 import { spawnSync } from 'child_process'
@@ -89,6 +89,11 @@ describe('boot first-message delivery (load-buffer + bracketed paste)', () => {
         readyGateSecs: 8,
         logDir: join(root, 'logs'),
       }
+      // pty-supervisor hosting is the DEFAULT now; this fixture exercises the legacy TMUX boot/delivery
+      // path (load-buffer + bracketed paste) explicitly, so opt this peer OUT of pty with a .no-pty-host
+      // marker (otherwise launch hosts it under the supervisor and the tmux-path assertions never apply).
+      mkdirSync(cfg.logDir, { recursive: true })
+      writeFileSync(join(cfg.logDir, `${spec.identity}.no-pty-host`), '')
       try {
         const r = await launch(spec, catAdapter(recv), firstMessage, cfg)
         expect(r.status).toBe('READY')

package/src/launch/index.ts

@@ -249,17 +249,22 @@ export const launch: LaunchFn = async (
   //       at a not-yet-created dir. Symmetric to the cfg.logDir mkdir before pipe-pane.
   mkdirSync(dirname(sock), { recursive: true })
 
-  // ── SPAWN-FLIP (cutover Block 2, Ф0a) — per-peer `.pty-host` flag, DARK by default ────────────────
-  // A flag-on tui peer is HOSTED by the supervisor (it owns the pty + boot-driver + pane-log) instead
+  // ── PTY-SUPERVISOR HOSTING — the DEFAULT (opt-out per-peer via `.no-pty-host`) ─────────────────────
+  // By default a tui peer is HOSTED by the supervisor (it owns the pty + boot-driver + pane-log) instead
   // of `tmux new-session`. The supervisor serves the SAME launch-composed argv+env (buildLaunchInvocation,
   // the single source the tmux path also uses), so the hosted session is parity-identical. Readiness is
   // read off the pane-log model (the supervisor's boot-driver answers startup dialogs internally);
   // delivery goes over the supervisor socket. UNCONDITIONAL SPAWN-FALLBACK: any host-bringup failure
-  // falls through to the tmux path below — a flipped peer is NEVER worse than tmux ON SPAWN. Flag-off →
-  // this whole block is skipped and the tmux path is byte-identical (golden). Routers are never hosted
-  // (infra, launchd-owned). @xterm stays out of THIS process (ptyHost: @xterm-free start + deliver +
-  // sessionAlive; readiness's @xterm import is dynamic and only loads here, flag-on).
-  if (adapter.kind === 'tui' && ptyHostEnabled(cfg.logDir, identity)) {
+  // falls through to the tmux path below — a hosted peer is NEVER worse than tmux ON SPAWN. Opt-OUT
+  // (`.no-pty-host` marker) → this whole block is skipped and the tmux path is byte-identical (golden);
+  // it is the dev/debug escape valid only while tmux still exists. Routers (telegram/notifier) are ALSO
+  // hosted by default (cutover infra-track): launchd STILL owns their lifecycle via run-infra (H4) — the
+  // supervisor only provides the pty + delivery socket + pane-log; the router branch below skips every
+  // TUI phase (no boot dialogs — BOOT_ADAPTERS has no router entry so the supervisor's boot-driver is
+  // skipped; no transcript ready-gate — newestActivityMtime=null). @xterm stays out of THIS process
+  // (ptyHost: @xterm-free start + deliver + sessionAlive; readiness's @xterm import is dynamic and only
+  // loads here, default-on — and the router branch never reaches it).
+  if ((adapter.kind === 'tui' || adapter.kind === 'router') && ptyHostEnabled(cfg.logDir, identity)) {
     const invocation = buildLaunchInvocation(spec, adapter, cfg)
     mkdirSync(cfg.logDir, { recursive: true, mode: 0o700 }) // the supervisor writes the pane-log here
     const paneLogPath = `${cfg.logDir}/${identity}.log`
@@ -272,6 +277,17 @@ export const launch: LaunchFn = async (
       invocation,
     })
     if (host.ok) {
+      // ROUTER (telegram/notifier): no startup dialogs and no transcript. The session is "up" the
+      // instant the supervisor child is serving — symmetric to the tmux router path, where launch
+      // returns READY the moment `tmux new-session` succeeds and the always-on caller (runAlwaysOn)
+      // does its own BOOT_RECHECK to catch an immediate child-death. Always-on routers launch with an
+      // EMPTY firstMessage; deliveries arrive LATER over the socket (deliverHosted → child stdin → the
+      // router's <iap>-marker stdin reader). So confirm the hosted session is live and return ready —
+      // no waitHostReady (would load @xterm for nothing), no first-message deliver, no ready-gate.
+      if (adapter.kind === 'router') {
+        if (hostSessionAlive(identity)) return ready(identity)
+        return fail(identity, 'hosted router session not alive immediately after bringup')
+      }
       // BOOT: the supervisor's boot-driver dismisses startup dialogs internally; wait for the input
       // surface via the pane-log model, then deliver over the socket + ready-gate on a model turn —
       // the SAME shape as the tmux boot/deliver/ready-gate below, with host equivalents.

package/src/launch/launchdRun.ts

@@ -23,6 +23,7 @@ import { buildProcessAddress, buildSocketPath } from '../core/socket.ts'
 import { peerLogsDir, pluginLogsDir } from '../storage/index.ts'
 import { readPeerProfile } from '../identity/index.ts'
 import { getAdapter, launch } from './index.ts'
+import { hostSessionAlive, killPtyHost } from './ptyHost.ts'
 import { dismissCanary, signalCanaryClean } from './canary.ts'
 import type { LaunchConfig, LaunchSpec } from './types.ts'
 
@@ -115,6 +116,14 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   const sock = buildSocketPath(runtime, personality, sockDir)
   const adapter = getAdapter(runtime)
 
+  // Host-aware liveness (cutover infra-track): a flag-on router is supervisor-HOSTED (no tmux session);
+  // a flag-off one is tmux. Probe BOTH backings by RUNTIME STATE (not the `.pty-host` marker), so this
+  // is robust to a spawn-FALLBACK — if startPtyHost failed and launch fell back to tmux, the marker is
+  // present yet the live session is tmux. The router is "up" iff EITHER backing is alive; on child
+  // death BOTH go false → block-watch exits → run-infra exits → launchd KeepAlive respawns (the SOLE
+  // respawn owner; the supervisor never self-respawns — H4 held).
+  const isAlive = (): boolean => hostSessionAlive(identity) || sessionAlive(sock, identity)
+
   const cfg: LaunchConfig = {
     claudeBin: env.CLAUDE_BIN ?? 'claude',
     codexBin: env.CODEX_BIN ?? 'codex',
@@ -143,7 +152,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   const spec = buildAlwaysOnSpec(personality, runtime, cwd, sockDir)
 
   // Idempotent: bring up only when not already live.
-  if (!sessionAlive(sock, identity)) {
+  if (!isAlive()) {
     const result = await launch(spec, adapter, '', cfg)
     if (result.status !== 'READY') {
       process.stderr.write(`launchdRun: launch FAILED for ${identity}: ${result.reason ?? 'unknown'}\n`)
@@ -155,7 +164,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
     // (a diagnostic, throttled by the plist) instead of a clean exit that reads as a
     // healthy run in the launchd logs.
     await sleep(BOOT_RECHECK_MS)
-    if (!sessionAlive(sock, identity)) {
+    if (!isAlive()) {
       process.stderr.write(
         `launchdRun: ${identity} session died immediately after launch — check ${cfg.notifierBin ?? `${runtime}-runtime`}\n`,
       )
@@ -175,7 +184,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   }
   process.on('SIGTERM', onSignal)
   process.on('SIGINT', onSignal)
-  while (!stop && sessionAlive(sock, identity)) {
+  while (!stop && isAlive()) {
     await new Promise<void>(resolve => {
       const timer = setTimeout(resolve, WATCH_INTERVAL_MS)
       interrupt = () => {
@@ -190,7 +199,14 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   // holding stale in-memory state (см. teardownAlwaysOnSession). A natural session
   // death (stop=false) skips this: there is nothing to tear down, exit 0 →
   // KeepAlive respawns a fresh bring-up.
-  if (stop) teardownAlwaysOnSession(sock, identity)
+  // Signal-initiated stop (bootout / shutdown / kickstart -k) tears the session down WITH this watcher.
+  // A hosted router → kill the supervisor daemon (killPtyHost: SIGTERM → it SIGKILLs the child + cleans
+  // up); a tmux router → the tmux teardown. Pick by the live backing. A NATURAL death (stop=false) skips
+  // this: nothing to tear down, exit 0 → KeepAlive respawns a fresh bring-up.
+  if (stop) {
+    if (hostSessionAlive(identity)) killPtyHost(identity)
+    else teardownAlwaysOnSession(sock, identity)
+  }
   return 0
 }
 

package/src/launch/ptyHost.test.ts

@@ -5,27 +5,32 @@ import { join } from 'node:path'
 import { ptyHostEnabled } from './ptyHost.ts'
 import { readyGatePtyFlipEnabled } from './readyGateModel.ts'
 
-describe('ptyHostEnabled — the spawn-flip per-peer flag', () => {
-  test('off by default; on when the .pty-host marker exists', () => {
+describe('ptyHostEnabled — pty-hosting is the DEFAULT, .no-pty-host opts out', () => {
+  test('ON by default (no marker needed); OFF when the .no-pty-host opt-out marker exists; per-peer', () => {
     const dir = mkdtempSync(join(tmpdir(), 'ptyhost-flag-'))
     try {
+      expect(ptyHostEnabled(dir, 'codex-x')).toBe(true) // DEFAULT: hosted out of the box, no marker
+      writeFileSync(join(dir, 'codex-x.no-pty-host'), '') // explicit opt-OUT → tmux
       expect(ptyHostEnabled(dir, 'codex-x')).toBe(false)
-      writeFileSync(join(dir, 'codex-x.pty-host'), '')
-      expect(ptyHostEnabled(dir, 'codex-x')).toBe(true)
-      expect(ptyHostEnabled(dir, 'codex-y')).toBe(false) // per-peer, not global
+      expect(ptyHostEnabled(dir, 'codex-y')).toBe(true) // opt-out is per-peer, not global — y stays default-on
     } finally {
       rmSync(dir, { recursive: true, force: true })
     }
   })
 
-  test('DISTINCT from the ready-gate flip marker — a readygate-flipped peer is NOT pty-hosted', () => {
+  test('legacy .pty-host opt-in marker is REDUNDANT (ignored); .pty-readygate is orthogonal; only .no-pty-host flips to tmux', () => {
     const dir = mkdtempSync(join(tmpdir(), 'ptyhost-distinct-'))
     try {
-      writeFileSync(join(dir, 'codex-perplex.pty-readygate'), '') // ready-gate flipped, still tmux-hosted
-      expect(readyGatePtyFlipEnabled(dir, 'codex-perplex')).toBe(true)
-      expect(ptyHostEnabled(dir, 'codex-perplex')).toBe(false) // the .pty-host marker is separate
+      // legacy opt-in marker no longer decides anything — pty is the default with or without it
       writeFileSync(join(dir, 'codex-perplex.pty-host'), '')
-      expect(ptyHostEnabled(dir, 'codex-perplex')).toBe(true) // now supervisor-hosted too
+      expect(ptyHostEnabled(dir, 'codex-perplex')).toBe(true)
+      // the ready-gate viewport-source marker is a SEPARATE concern — it does not decide pty-hosting
+      writeFileSync(join(dir, 'codex-perplex.pty-readygate'), '')
+      expect(readyGatePtyFlipEnabled(dir, 'codex-perplex')).toBe(true)
+      expect(ptyHostEnabled(dir, 'codex-perplex')).toBe(true) // still hosted (default)
+      // only the explicit opt-out marker flips it back to tmux
+      writeFileSync(join(dir, 'codex-perplex.no-pty-host'), '')
+      expect(ptyHostEnabled(dir, 'codex-perplex')).toBe(false)
     } finally {
       rmSync(dir, { recursive: true, force: true })
     }

package/src/launch/ptyHost.ts

@@ -26,12 +26,17 @@ import type { RuntimeAdapter } from './types.ts'
 export const HOST_COLS = 220
 export const HOST_ROWS = 50
 
-/** Per-peer spawn-flip flag: marker `<logDir>/<identity>.pty-host`. Present → launch hosts the session
- *  under the supervisor instead of `tmux new-session`. DISTINCT from `.pty-readygate` (the ready-gate
- *  viewport-source flip): a readygate-flipped peer is still tmux-HOSTED and stays under observer
- *  cross-check; only a `.pty-host` peer is supervisor-hosted (cross-check retires for it). */
+/** Per-peer pty-hosting decision. pty-supervisor hosting is the DEFAULT — a fresh peer is hosted under
+ *  the supervisor (not `tmux new-session`) WITHOUT any marker (Артур: «pty из коробки»). A peer opts OUT
+ *  to the legacy tmux path with a `<logDir>/<identity>.no-pty-host` marker (the dev/debug escape, valid
+ *  only while tmux still exists). Read in TWO places, both of which want "is this peer pty-hosted": the
+ *  spawn-gate (launch — host vs tmux) and the shadow observer (skip pty-hosted peers, they have no tmux
+ *  to compare; an opt-OUT peer is tmux → compared). Legacy `.pty-host` opt-in markers are now REDUNDANT
+ *  (pty is the default) and harmless — ignored here, so the 29 migrated peers keep hosting unchanged.
+ *  The golden spawn-fallback (startPtyHost fail → tmux, in launch) is SEPARATE and unaffected: a
+ *  pty-default peer whose host bring-up fails still falls through to tmux — never worse on spawn. */
 export function ptyHostEnabled(logDir: string, identity: string): boolean {
-  return existsSync(`${logDir}/${identity}.pty-host`)
+  return !existsSync(`${logDir}/${identity}.no-pty-host`)
 }
 
 /** The supervisor's run dir (session sockets/pids/serve-specs). Env-isolatable via IAPEER_ROOT. */

package/src/launch/sockdir.test.ts

@@ -4,7 +4,7 @@
 // not-yet-created dir (prod sock=/tmp always exists; this bit a sandbox pilot).
 
 import { afterEach, describe, expect, test } from 'bun:test'
-import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'fs'
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'fs'
 import { tmpdir } from 'os'
 import { dirname, join } from 'path'
 import { spawnSync } from 'child_process'
@@ -51,6 +51,11 @@ describe('launch creates a missing socket dir', () => {
       alwaysOn: true,
     }
 
+    // pty-supervisor hosting is the DEFAULT; this regression tests the legacy TMUX new-session sock-dir
+    // mkdir, so opt this peer OUT of pty with a .no-pty-host marker (else it is pty-hosted and the tmux
+    // mkdir never runs).
+    mkdirSync(cfg.logDir, { recursive: true })
+    writeFileSync(join(cfg.logDir, `${spec.identity}.no-pty-host`), '')
     try {
       // The regression assertion: before the fix the dir was NOT created and
       // `tmux new-session -S <sock>` failed silently; now launch mkdir's it. (We assert

package/src/shadow/enumerate-skip.test.ts

@@ -1,10 +1,11 @@
 // Spawn-flip cutover Block 2, Ф0b-3 slice 3b — the fidelity observer SKIPS supervisor-hosted peers.
 //
-// The observer compares the pty-model vs LIVE TMUX. A `.pty-host`-designated peer has no tmux to
-// compare against, and during a flip a lingering tmux socket for it would surface FALSE divergences.
-// This proves the explicit skip fires IN enumerate even in that race (a live tmux session + a pane-log
-// present): the marked peer is NOT enrolled, while an unmarked sibling IS. Real-tmux, guarded (a clean
-// CI runner has no tmux; the release machine has it — same pattern as routesend-wake).
+// The observer compares the pty-model vs LIVE TMUX. pty-hosting is now the DEFAULT, so a normal
+// (unmarked) peer has no tmux to compare against — and during a flip a lingering tmux socket for it
+// would surface FALSE divergences. This proves the skip fires IN enumerate even in that race (a live
+// tmux session + a pane-log present): the default peer is NOT enrolled, while a `.no-pty-host` opt-out
+// (tmux) sibling IS. Real-tmux, guarded (a clean CI runner has no tmux; the release machine has it —
+// same pattern as routesend-wake).
 import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
 import { spawnSync } from 'node:child_process'
 import { closeSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
@@ -17,8 +18,8 @@ const tmuxAvailable = spawnSync('tmux', ['-V'], { stdio: 'ignore' }).status ===
 
 let sockDir: string
 let logDir: string
-const KEEP = 'keepobs' // unmarked → observed
-const SKIP = 'skipobs' // .pty-host marker → skipped
+const KEEP = 'keepobs' // .no-pty-host opt-out (tmux) → observed
+const SKIP = 'skipobs' // default (no marker) → pty-hosted → skipped
 const addrOf = (p: string) => `codex-${p}`
 const sockOf = (p: string) => buildSocketPath('codex', p, sockDir)
 
@@ -43,9 +44,10 @@ beforeAll(() => {
     startTmux(p)
     writeFileSync(join(logDir, `${addrOf(p)}.log`), '')
   }
-  // SKIP additionally carries the `.pty-host` designation — even WITH a live tmux session, the observer
-  // must not enroll it (the flip-transition race the skip guards against).
-  writeFileSync(join(logDir, `${addrOf(SKIP)}.pty-host`), '')
+  // KEEP carries the `.no-pty-host` opt-OUT → it is on tmux, so the observer MUST compare it. SKIP is a
+  // DEFAULT (unmarked) peer → pty-hosted → skipped even WITH a lingering live tmux session (the
+  // flip-transition race the skip guards against).
+  writeFileSync(join(logDir, `${addrOf(KEEP)}.no-pty-host`), '')
 })
 
 afterAll(() => {
@@ -54,12 +56,12 @@ afterAll(() => {
   rmSync(logDir, { recursive: true, force: true })
 })
 
-describe.if(tmuxAvailable)('observer enumerate skips supervisor-hosted (.pty-host) peers', () => {
-  test('a .pty-host peer is NOT enrolled even with a live tmux session + pane-log; an unmarked one IS', () => {
+describe.if(tmuxAvailable)('observer enumerate skips pty-default peers, compares .no-pty-host (tmux) peers', () => {
+  test('a default (unmarked, pty-hosted) peer is NOT enrolled despite a live tmux session; a .no-pty-host opt-out one IS', () => {
     const models = new Map<string, any>()
     enumerate(models, { sockDir, logDir, eventLogDir: logDir })
-    expect(models.has(addrOf(KEEP))).toBe(true) // unmarked → observed (live tmux + log present)
-    expect(models.has(addrOf(SKIP))).toBe(false) // .pty-host designation → skipped despite live tmux
+    expect(models.has(addrOf(KEEP))).toBe(true) // .no-pty-host opt-out (tmux) → observed (live tmux + log)
+    expect(models.has(addrOf(SKIP))).toBe(false) // default pty-hosted → skipped despite lingering live tmux
     for (const o of models.values()) { try { if (o.fd != null) closeSync(o.fd) } catch { /* */ } }
   })
 })

package/src/shadow/index.ts

@@ -61,9 +61,11 @@ export function enumerate(models: Map<string, Obs>, opts: ShadowOptions, tracker
   for (const p of peers) {
     const addr = buildProcessAddress(p.runtime, p.personality)
     // SPAWN-FLIP Ф0b-3: NEVER measure a supervisor-HOSTED peer. The observer's premise is pty-model vs
-    // LIVE TMUX; a `.pty-host`-designated peer has no tmux to compare against, and during a flip a
-    // lingering tmux socket for it would surface false divergences. Skip by the migration DESIGNATION
-    // (marker), BEFORE `live` — a peer flipped while enrolled then falls out of `live` and is reaped.
+    // LIVE TMUX, so it only compares peers that are actually on tmux. pty-hosting is now the DEFAULT, so
+    // ptyHostEnabled is true for a normal peer (hosted → skip) and false only for an explicit `.no-pty-host`
+    // opt-OUT peer (tmux → compared). Skip BEFORE `live` — a peer that flips falls out of `live` and is
+    // reaped. (Post-migration the whole fleet is pty-default, so this skips everything and the observer is
+    // effectively retired until/unless a peer opts back to tmux.)
     if (ptyHostEnabled(opts.logDir, addr)) continue
     live.add(addr)
     if (models.has(addr)) continue

package/src/transport/hostDeliver.test.ts

@@ -100,3 +100,38 @@ describe('deliverWarm — hosted target delivers over the socket + confirms by t
     expect(mtimeProbes).toBe(0) // no cwd → the transcript proxy is never consulted
   })
 })
+
+// Cutover infra-track — a hosted ROUTER (telegram/notifier) has NO transcript proxy
+// (adapter.newestActivityMtime=null), so the mtime-advance confirm a TUI uses can never be satisfied
+// and would false-FAIL every router delivery. The host path confirms a router by the socket-ack —
+// PARITY with deliverViaTmux's router C-j path (delivery-level confirm; router liveness is structural
+// via launchd, not a model turn). These cases pin that behavior.
+const routerTarget: DeliveryTarget = {
+  runtime: 'notifier', // notifierAdapter.kind === 'router'
+  personality: 'timer',
+  address: 'notifier-timer',
+  socketPath: '/tmp/nonexistent-iap-test.sock',
+}
+
+describe('deliverWarm — hosted ROUTER confirms by socket-ack (no transcript proxy)', () => {
+  test('router deliver ok → ok EVEN THOUGH mtime never advances (the exact scenario a TUI fails on)', async () => {
+    process.env.IAP_HOST_LIVENESS_GRACE_MS = '0' // a mtime-gated path would fail at once here
+    const seam: WarmDeliverSeam = {
+      hostAlive: () => true,
+      deliverHosted: async () => ({ ok: true }),
+      newestActivityMtime: () => 100, // constant — a router writes no transcript; a TUI here → loud fail
+    }
+    const r = await deliverWarm(routerTarget, '<iap>x</iap>', '/peer/cwd', seam)
+    expect(r.ok).toBe(true) // socket-ack IS the confirm for a router; the non-advancing transcript is irrelevant
+  })
+
+  test('router socket deliver fails (dead/stalled) → loud fail, no false ok', async () => {
+    const seam: WarmDeliverSeam = {
+      hostAlive: () => true,
+      deliverHosted: async () => ({ ok: false, error: 'socket dead during paste' }),
+    }
+    const r = await deliverWarm(routerTarget, '<iap>x</iap>', '/peer/cwd', seam)
+    expect(r.ok).toBe(false)
+    if (!r.ok) expect(r.error.message).toContain('deliver failed')
+  })
+})

package/src/transport/index.ts

@@ -564,6 +564,13 @@ async function deliverViaHost(
         `message NOT delivered`,
     )
   }
+  // Router (telegram/notifier): no transcript proxy (adapter.newestActivityMtime=null) → the
+  // mtime-advance confirm below can NEVER be satisfied and would false-FAIL every router delivery.
+  // Confirm by the socket-ack just obtained — PARITY with deliverViaTmux's router path (C-j success =
+  // delivery-level confirm; a router's liveness is structural via launchd KeepAlive, not a model
+  // turn). See deliverViaTmux router branch (paste-buffer -r + C-j, no transcript confirm) + its
+  // header note "router … liveness is structural".
+  if (adapter.kind === 'router') return ok(undefined)
   // socket-ack ≠ landed. With no activity proxy (direct callers/tests without a cwd) we can only
   // trust the flushed submit — confirmed-only, mirroring deliverViaTmux's legacy-caller path.
   if (!cwd) return ok(undefined)