@agfpd/iapeer 0.2.93 → 0.2.95

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.93",
+  "version": "0.2.95",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/init/index.ts

@@ -298,6 +298,12 @@ export function resolvePrimaryRuntime(
   isInstalled: (rt: Runtime) => boolean = rt => isRuntimeInstalled(rt),
 ): Runtime {
   if (explicit) {
+    // Infra runtimes (notifier/telegram) are NOT agentic binaries — their presence is
+    // the npx runtime package + the launchd plist, not a claude/codex install. The
+    // install-check below is agentic-only, so an explicit infra runtime must pass
+    // straight through; otherwise re-deploying an infra peer (install-runtime /
+    // update-runtime → createPeer → initPeer) wrongly fails "not installed".
+    if (isInfraRuntime(explicit)) return explicit
     if (!isInstalled(explicit)) {
       throw new IapError(
         `runtime "${explicit}" is not installed on this host — install it (Claude Code / Codex CLI) or choose an installed runtime`,

package/src/launch/cmdlog.ts

@@ -38,6 +38,14 @@ import { join } from 'path'
 export const CMDLOG_CAP_BYTES = 8 * 1024 * 1024
 export const CMDLOG_KEEP_BYTES = 1024 * 1024
 
+/** Pane-log tail-keep cap (capPaneLogs): a per-identity pane-log over CAP is cut to
+ *  its last KEEP. KEEP_BYTES INVARIANT — must stay ≥ the pane-log reader's seed
+ *  window (readyGateModel SEED_BYTES = 4 MiB, the tail fed into the headless xterm
+ *  for composer-occupancy / viewport detection); capping below it would starve that
+ *  reader of the tail it reconstructs the live screen from. 8 MiB = 2× the seed. */
+export const PANELOG_CAP_BYTES = 32 * 1024 * 1024
+export const PANELOG_KEEP_BYTES = 8 * 1024 * 1024
+
 const CMDLOG_SUBDIR = 'tmux-cmdlog'
 
 /** The per-identity command-log dir: <eventLogDir>/tmux-cmdlog/<identity>. The
@@ -78,12 +86,34 @@ export function hardenCmdLogDir(dir: string): void {
   }
 }
 
+/** Tail-keep ONE file: if it exceeds capBytes, rewrite it as its last keepBytes.
+ *  Safe against a live O_APPEND writer (tmux `cat >>`, the supervisor append-fd):
+ *  the next write lands at the new EOF (proven by live truncation test). Lines
+ *  appended between the tail-read and the rewrite are lost — acceptable mid-life
+ *  noise. Returns true iff the file was capped. Best-effort: swallows FS errors. */
+function tailKeepFile(path: string, capBytes: number, keepBytes: number): boolean {
+  try {
+    if (statSync(path).size <= capBytes) return false
+    const fd = openSync(path, 'r')
+    let tail: Buffer
+    try {
+      const size = fstatSync(fd).size
+      const start = Math.max(0, size - keepBytes)
+      tail = Buffer.alloc(Math.min(keepBytes, size))
+      readSync(fd, tail, 0, tail.length, start)
+    } finally {
+      closeSync(fd)
+    }
+    writeFileSync(path, tail, { mode: 0o600 })
+    return true
+  } catch {
+    return false // per-file best-effort
+  }
+}
+
 /** Tail-keep cap over every command log under <eventLogDir>/tmux-cmdlog/<identity>.
- *  A file over capBytes is rewritten as its last keepBytes. Safe against the
- *  live writer: tmux logs with O_APPEND, so the server's next write lands at
- *  the new EOF (proven by live truncation test). Lines appended between the
- *  tail-read and the rewrite are lost — acceptable mid-life noise; the death
- *  tail is never here because the peer is alive while being capped. */
+ *  A file over capBytes is rewritten as its last keepBytes. The death tail is never
+ *  here because the peer is alive while being capped. */
 export function capCmdLogs(
   eventLogDir: string,
   capBytes: number = CMDLOG_CAP_BYTES,
@@ -107,24 +137,36 @@ export function capCmdLogs(
     for (const name of files) {
       if (!name.endsWith('.log')) continue
       const path = join(dir, name)
-      try {
-        if (statSync(path).size <= capBytes) continue
-        const fd = openSync(path, 'r')
-        let tail: Buffer
-        try {
-          const size = fstatSync(fd).size
-          const start = Math.max(0, size - keepBytes)
-          tail = Buffer.alloc(Math.min(keepBytes, size))
-          readSync(fd, tail, 0, tail.length, start)
-        } finally {
-          closeSync(fd)
-        }
-        writeFileSync(path, tail, { mode: 0o600 })
-        capped.push(path)
-      } catch {
-        /* per-file best-effort */
-      }
+      if (tailKeepFile(path, capBytes, keepBytes)) capped.push(path)
     }
   }
   return capped
 }
+
+/** Tail-keep cap over the per-identity PANE-LOGS (<logDir>/<identity>.log) — the RAW
+ *  TUI byte stream that pipe-pane (tmux) / the supervisor append for a session's whole
+ *  life. Unlike the lifecycle/delivery logs (their own size-rotation under logs/iapeer),
+ *  the pane-log had NO bound and grew to hundreds of MB per warm peer on an always-on
+ *  host. The supervise tick caps it here with the same tail-keep mechanism as the
+ *  cmd-logs. logDir (logs/lifecycle) holds ONLY pane-logs, so only top-level *.log is
+ *  touched — never the rotated logs elsewhere. KEEP_BYTES stays ≥ the reader seed
+ *  window (see PANELOG_KEEP_BYTES). Best-effort by construction. */
+export function capPaneLogs(
+  logDir: string,
+  capBytes: number = PANELOG_CAP_BYTES,
+  keepBytes: number = PANELOG_KEEP_BYTES,
+): string[] {
+  const capped: string[] = []
+  let names: string[]
+  try {
+    names = readdirSync(logDir)
+  } catch {
+    return capped
+  }
+  for (const name of names) {
+    if (!name.endsWith('.log')) continue
+    const path = join(logDir, name)
+    if (tailKeepFile(path, capBytes, keepBytes)) capped.push(path)
+  }
+  return capped
+}

package/src/launch/launchd.ts

@@ -63,6 +63,24 @@ export function isFoundationOwnedPlist(path: string): boolean {
   }
 }
 
+/** Read one EnvironmentVariables value from an already-written plist. Used to
+ *  PRESERVE a host-specific env var across a plist regeneration (install-runtime
+ *  rewrites the plist from scratch, which would otherwise drop it). Returns
+ *  undefined when the file / key is absent or unreadable. The key is a literal
+ *  env-var name (no regex metachars) and the values we preserve are constrained
+ *  identifiers (no XML entities), so a direct `<key>…</key><string>…</string>`
+ *  match is sufficient. */
+function readPlistEnvVar(path: string, key: string): string | undefined {
+  try {
+    const m = readFileSync(path, 'utf8').match(
+      new RegExp(`<key>${key}</key>\\s*<string>([^<]*)</string>`),
+    )
+    return m ? m[1] : undefined
+  } catch {
+    return undefined
+  }
+}
+
 /**
  * Resolve an executable to an ABSOLUTE path against `env.PATH` (the RICH
  * provisioning PATH), so the result can be baked into a launchd plist whose own
@@ -576,6 +594,22 @@ export function installAlwaysOnPlist(opts: InstallAlwaysOnPlistOptions): string
     const resolved = opts.runtimeBin ?? resolveExecutable(INFRA_RUNTIME_DEFAULT_BIN[opts.runtime] ?? opts.runtime, env)
     if (resolved) environment[binEnvVar] = resolved
   }
+  // Host-specific notifier fallback backstop (NOTIFIER_FALLBACK_TARGET): the final
+  // human target the notifier's alarm chain falls back to when every other delivery
+  // fails. DELIBERATELY host-resolved at generation time (like NOTIFIER_RUNTIME_BIN
+  // above), NEVER a hardcoded literal — a baked peer name would ship in the public
+  // package and inject a non-existent target into every foreign install's plist (the
+  // exact foreign-install break the notifier package removed from its own default).
+  // Source: env when the operator sets it, else PRESERVE the value already baked in
+  // THIS host's existing plist so a regeneration (install-runtime rewrites the file)
+  // never drops it. Unset on a fresh / foreign host → not baked → the notifier
+  // package's own default applies. Notifier-only (the var is notifier-scoped).
+  if (opts.runtime === 'notifier') {
+    const fallback =
+      env.NOTIFIER_FALLBACK_TARGET?.trim() ||
+      (existsSync(path) ? readPlistEnvVar(path, 'NOTIFIER_FALLBACK_TARGET') : undefined)
+    if (fallback) environment.NOTIFIER_FALLBACK_TARGET = fallback
+  }
   const spec: LaunchdPlistSpec = {
     label: launchdLabel(opts.personality),
     programArguments: [...(opts.entrypointArgv ?? defaultEntrypointArgv(env)), opts.personality, opts.runtime],

package/src/lifecycle/index.ts

@@ -26,7 +26,7 @@ import {
 } from '../core/constants.ts'
 import { buildProcessAddress, buildSocketPath, parseSessionName } from '../core/socket.ts'
 import { err, ok, type Result } from '../core/errors.ts'
-import { capCmdLogs, cmdLogDirFor } from '../launch/cmdlog.ts'
+import { capCmdLogs, capPaneLogs, cmdLogDirFor } from '../launch/cmdlog.ts'
 import { resolveGlobalRoot } from '../storage/index.ts'
 import { readPeerProfile, resolveIdentity } from '../identity/index.ts'
 import {
@@ -1217,6 +1217,14 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
   // over the cap. Best-effort by construction; the killer's command is the LAST
   // line of a dying log, so capping a LIVE peer's log never costs the death tail.
   capCmdLogs(cfg.eventLogDir)
+  // Pane-log volume cap (launch/cmdlog.ts capPaneLogs): the per-identity pane-log
+  // (<logDir>/<identity>.log) is the RAW TUI byte stream pipe-pane/the supervisor
+  // append for a session's whole life — it had NO bound and grew to hundreds of MB
+  // per warm peer on an always-on host. Tail-keep it each tick (KEEP ≥ the occupancy
+  // reader's 4 MiB seed window, so capping never starves composer detection).
+  // Not H4-gated: log janitoring is orthogonal to lifecycle ownership, so launchd-
+  // managed peers' pane-logs are capped too. Best-effort by construction.
+  capPaneLogs(cfg.logDir)
   // Durable decision trace (eventlog.ts): every reap/death/eager-fresh gets a line
   // so a postmortem can answer "when & how did peer X's prior session end" even
   // after the .idle-reaped / .deaths markers are consumed. alive / skipped-launchd