@agfpd/iapeer 0.2.94 → 0.2.96

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.94",
+  "version": "0.2.96",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -946,8 +946,8 @@ const USAGE = `usage: iapeer <verb> [args]
   version | --version | -v                                       print the installed binary's version
   help | --help | -h                                             print this usage (works appended to any verb; executes nothing)
   daemon [--install-plist]                                       run the host-wide HTTP-MCP router (launchd-held)
-  onboard [--dry-run] [--no-notifier] [--no-telegram] [--telegram-human <p>] [--telegram-user-id <id>] [--no-memory] [--memory <pkg>] [--infra <csv>]
-                                                                 backbone host-phase: marketplace → notifier → telegram (human peer) → memory (all default YES)
+  onboard [--accept-risk] [--dry-run] [--no-notifier] [--no-telegram] [--telegram-human <p>] [--telegram-user-id <id>] [--no-memory] [--memory <pkg>] [--infra <csv>]
+                                                                 backbone host-phase: marketplace → notifier → telegram (human peer) → memory (all default YES). --accept-risk (or IAPEER_ACCEPT_RISK=1) accepts the security warning non-interactively
   status                                                         host snapshot: version, daemon health, memory slot (<provider> | none)
   install-runtime <runtime> [--package pkg] [--npx]              npx-install a runtime package + deploy its declared peer-set
   update-runtime <runtime> | --all [--force]                     version-gate → re-install + re-provision declared set → restart the runtime's peers
@@ -1002,6 +1002,18 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
   try {
     switch (verb) {
       case 'onboard': {
+        // SECURITY GATE (pre-release): the operator must consciously accept the risk of
+        // beta infra with live agents BEFORE onboard mutates the host. --accept-risk /
+        // IAPEER_ACCEPT_RISK accepts non-interactively (one-liner installers / CI); a
+        // TTY is prompted; a non-TTY without the flag is REFUSED with how-to (never a
+        // silent proceed / hang). SKIPPED for --dry-run (a read-only preview mutates
+        // nothing, so there is no risk to accept yet). Runs BEFORE daemon/peer steps.
+        if (flags['dry-run'] !== true) {
+          const { confirmOnboardRisk } = await import('../onboard/risk.ts')
+          const gate = await confirmOnboardRisk({ accept: flags['accept-risk'] === true, env, out, errOut })
+          if (gate === 'refused-non-tty') return 2 // explicit refusal: how-to printed
+          if (gate === 'declined') return 1 // operator said no
+        }
         // Host-phase: register OUR marketplace in claude + codex (IDEMPOTENT — detect
         // → skip when present; an already-configured host is a no-op). --dry-run
         // reports the would-be actions without touching anything. --infra <csv> ALSO

package/src/init/index.ts

@@ -298,6 +298,12 @@ export function resolvePrimaryRuntime(
   isInstalled: (rt: Runtime) => boolean = rt => isRuntimeInstalled(rt),
 ): Runtime {
   if (explicit) {
+    // Infra runtimes (notifier/telegram) are NOT agentic binaries — their presence is
+    // the npx runtime package + the launchd plist, not a claude/codex install. The
+    // install-check below is agentic-only, so an explicit infra runtime must pass
+    // straight through; otherwise re-deploying an infra peer (install-runtime /
+    // update-runtime → createPeer → initPeer) wrongly fails "not installed".
+    if (isInfraRuntime(explicit)) return explicit
     if (!isInstalled(explicit)) {
       throw new IapError(
         `runtime "${explicit}" is not installed on this host — install it (Claude Code / Codex CLI) or choose an installed runtime`,

package/src/onboard/risk.ts

@@ -0,0 +1,110 @@
+// Onboard security gate (pre-release): the operator must consciously accept the
+// risk of running beta infra with live agents BEFORE onboard mutates the host
+// (daemon start + peer registration). The warning text is the owner's verbatim
+// disclaimer — do NOT reword it.
+//
+// BOUNDARY: this must never break a NON-INTERACTIVE onboard (a one-liner installer /
+// automation calls onboard without a TTY). Acceptance paths:
+//   • --accept-risk (CLI flag) or IAPEER_ACCEPT_RISK=1 (env) → accept, no prompt
+//     (the explicit non-interactive channel);
+//   • a real TTY → show the warning and require a y/yes answer;
+//   • a NON-TTY without the flag → REFUSE with how-to (never a silent proceed, never
+//     a hang waiting on stdin that no one will type into).
+
+/** The owner's verbatim security disclaimer. Shown at the top of an interactive
+ *  onboard and in the non-interactive refusal. Word-for-word — do not edit. */
+export const ONBOARD_SECURITY_WARNING = `Security warning — please read.
+
+iapeer is beta infrastructure for live AI agents on your machine. Expect sharp edges.
+
+It starts a local daemon, registers peers, and routes messages between Claude Code,
+Codex CLI, Telegram humans, and services. If tools, memory, or project files are
+enabled, a bad prompt can make an agent do unsafe things.
+
+iapeer is not a hostile multi-user security boundary.
+Do not expose it to untrusted users, untrusted Telegram chats, or the public internet.
+
+State, profiles, logs, memory, and runtime configuration live under ~/.iapeer and
+peer-local .iapeer folders. Treat that data as sensitive.
+
+If you are not comfortable with local daemons, filesystem access, Telegram bot tokens,
+and agent tool permissions, do not continue.
+
+Recommended baseline:
+- localhost only;
+- private Telegram bots/chats only;
+- least-privilege project folders and tools;
+- no secrets in reachable files;
+- review peers, memory, logs, and configs after onboarding.
+
+I understand this is powerful and inherently risky. Continue?`
+
+/** How the onboard verb should react after the gate. */
+export type RiskGateResult =
+  | 'accepted-flag' // --accept-risk / IAPEER_ACCEPT_RISK → non-interactive accept (no prompt)
+  | 'accepted-prompt' // interactive TTY answered y/yes
+  | 'declined' // interactive TTY answered no → abort
+  | 'refused-non-tty' // no TTY and no accept flag → refuse with how-to (never proceed)
+
+export interface RiskGateOptions {
+  /** The --accept-risk CLI flag. */
+  accept?: boolean
+  env?: NodeJS.ProcessEnv
+  /** Override TTY detection (tests). Default: stdin AND stdout are TTYs. */
+  isTty?: boolean
+  /** Injectable prompt (tests). Default: a readline question on the live TTY. */
+  ask?: () => Promise<string>
+  /** stdout sink (default process.stdout). */
+  out?: (s: string) => void
+  /** stderr sink (default process.stderr). */
+  errOut?: (s: string) => void
+}
+
+const RISK_ENV = 'IAPEER_ACCEPT_RISK'
+
+function envAccepts(env: NodeJS.ProcessEnv): boolean {
+  return /^(1|true|yes)$/i.test((env[RISK_ENV] ?? '').trim())
+}
+
+async function defaultAsk(): Promise<string> {
+  const { createInterface } = await import('node:readline/promises')
+  const rl = createInterface({ input: process.stdin, output: process.stdout })
+  try {
+    return (await rl.question('')).trim()
+  } finally {
+    rl.close()
+  }
+}
+
+/**
+ * Confirm the operator accepts the onboard risk. Returns the gate outcome; the
+ * caller maps a non-accept outcome to a non-zero exit. Never throws, never hangs a
+ * non-interactive run: the flag/env path is silent-accept, a TTY is prompted, a
+ * non-TTY without the flag is refused with the exact how-to.
+ */
+export async function confirmOnboardRisk(opts: RiskGateOptions = {}): Promise<RiskGateResult> {
+  const env = opts.env ?? process.env
+  const out = opts.out ?? ((s: string) => void process.stdout.write(s))
+  const errOut = opts.errOut ?? ((s: string) => void process.stderr.write(s))
+
+  // Non-interactive accept channel (one-liner installers / automation).
+  if (opts.accept === true || envAccepts(env)) return 'accepted-flag'
+
+  const tty = opts.isTty ?? (process.stdin.isTTY === true && process.stdout.isTTY === true)
+  if (!tty) {
+    // No one to answer the prompt — refuse LOUD with how-to, never a silent proceed.
+    errOut(
+      `${ONBOARD_SECURITY_WARNING}\n\n` +
+        `Non-interactive onboard: no TTY to confirm. Re-run with --accept-risk ` +
+        `(or set ${RISK_ENV}=1) to accept this risk explicitly.\n`,
+    )
+    return 'refused-non-tty'
+  }
+
+  out(`${ONBOARD_SECURITY_WARNING} `)
+  const ask = opts.ask ?? defaultAsk
+  const answer = (await ask()).trim().toLowerCase()
+  if (answer === 'y' || answer === 'yes') return 'accepted-prompt'
+  out('onboard aborted — risk not accepted.\n')
+  return 'declined'
+}