@agfpd/iapeer 0.4.15 → 0.4.16

package/CHANGELOG.md

@@ -10,6 +10,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.16] - 2026-06-21
+
+### Fixed
+
+- Idle-reap now uses the pane-log (TUI render-stream) mtime as its activity proxy, not the
+  transcript file mtime. A live claude session re-touches its session `.jsonl` periodically
+  *without a real turn*, so the transcript proxy never crossed `idleSecs` and **claude peers
+  never idle-reaped** — the fleet piled up warm while codex peers (whose session file isn't
+  re-touched) reaped normally. The pane-log goes truly quiet at the prompt, so idle peers now
+  reap as intended. Pane-log primary; transcript fallback only when the pane-log is missing
+  (legacy supervisor); the launch ready-gate still uses the transcript.
+
 ## [0.4.15] - 2026-06-21
 
 ### Fixed
@@ -233,7 +245,8 @@ Initial public release — the foundation core of the iapeer multi-agent ecosyst
 - **Heterogeneous peers** — AI agents (Claude, Codex), humans (Telegram), and services
   (timer = cron, watcher = event) are all first-class and addressed the same way.
 
-[Unreleased]: https://github.com/agfpd/iapeer/compare/v0.4.15...HEAD
+[Unreleased]: https://github.com/agfpd/iapeer/compare/v0.4.16...HEAD
+[0.4.16]: https://github.com/agfpd/iapeer/compare/v0.4.15...v0.4.16
 [0.4.15]: https://github.com/agfpd/iapeer/compare/v0.4.14...v0.4.15
 [0.4.14]: https://github.com/agfpd/iapeer/compare/v0.4.13...v0.4.14
 [0.4.13]: https://github.com/agfpd/iapeer/compare/v0.4.12...v0.4.13

package/README.md

@@ -20,18 +20,18 @@ Agents on Claude and on Codex are different AI runtimes from different vendors,
 ## How it works
 
 ```text
-send_to_peer(name, text)     ← from any peer
+send_to_peer(name, text)   ← from any peer
         │
         ▼
-router daemon   — always on; finds the recipient, checks liveness, delivers
+router daemon              — always on; finds the recipient, checks liveness, delivers
         │
         ▼
-recipient peer  — asleep? the daemon wakes it and delivers on wake
+recipient peer             — asleep? the daemon wakes it and delivers on wake
 ```
 
 ## What makes it different
 
-- **Real interactive CLI sessions, not headless one-shots.** Each AI peer is a full Claude Code or Codex CLI session, not a disposable `claude -p` / `codex exec` call (as of 2026-06-15, `claude -p` no longer counts against the subscription's main usage limits).
+- **Real interactive CLI sessions, not headless one-shots.** Each AI peer is a full Claude Code or Codex CLI session, not a disposable `claude -p` / `codex exec` call.
 - **Warm-on-demand lifecycle.** A live session answers fast; after about an hour idle the daemon closes it; the next message brings it back with its context resumed. The message flow drives the lifecycle, not a human's presence.
 - **One identity across runtimes, with one memory.** A peer's `personality` is decoupled from its runtime: the same peer runs on Claude or Codex, switched with a command. By default (set up by `iapeer onboard`) it carries one shared memory (iapeer-memory) keyed to the personality, not the runtime — one personality, one memory, whatever runtime it runs on.
 - **Heterogeneous peers, one protocol.** AI agents, humans (Telegram), and services (timer = cron, watcher = event) are all first-class, addressed the same way over an always-on MCP daemon that exposes exactly one tool, `send_to_peer`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.15",
+  "version": "0.4.16",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/core/constants.ts

@@ -56,7 +56,7 @@ export function normalizeIntelligenceValue(value: unknown): Intelligence | undef
   return LEGACY_INTELLIGENCE[value]
 }
 
-const NATURAL_RUNTIMES = new Set(['telegram', 'discord', 'matrix', 'email', 'web'])
+const NATURAL_RUNTIMES = new Set(['telegram', 'discord', 'matrix', 'email', 'web', 'voicetalk'])
 const ABSENT_RUNTIMES = new Set(['notifier', 'webhook', 'api', 'cron'])
 
 export function defaultIntelligenceForRuntime(runtime: string): Intelligence {
@@ -67,12 +67,12 @@ export function defaultIntelligenceForRuntime(runtime: string): Intelligence {
 
 // Infra runtimes are ALWAYS-ON (held live by launchd KeepAlive), as opposed to the
 // warm-on-demand agentic runtimes (claude/codex, woken by the daemon). Liveness is
-// a property of the RUNTIME, not the personality (zone Идентичность). Both infra
-// runtimes are routers with a tmux endpoint: telegram receives inbound messages,
-// notifier receives send_to_peer(timer|watcher, …) registration/live-reload — so
-// each needs a live tmux pane for the daemon's deliverViaTmux to paste into. This
-// set gates always-on launchd plist generation (src/launch/launchd.ts).
-const INFRA_RUNTIMES = new Set(['notifier', 'telegram'])
+// a property of the RUNTIME, not the personality (zone Идентичность). Infra runtimes
+// are routers hosted by the pty supervisor: telegram/voicetalk carry a human channel
+// (inbound messages / voice), notifier receives send_to_peer(timer|watcher, …)
+// registration/live-reload — outbound to each is deliverHosted → the child's stdin.
+// This set gates always-on launchd plist generation (src/launch/launchd.ts).
+const INFRA_RUNTIMES = new Set(['notifier', 'telegram', 'voicetalk'])
 
 export function isInfraRuntime(runtime: string): boolean {
   return INFRA_RUNTIMES.has(runtime)
@@ -89,6 +89,7 @@ export function isInfraRuntime(runtime: string): boolean {
 export const INFRA_RUNTIME_BIN_ENV: Readonly<Record<string, string>> = {
   notifier: 'NOTIFIER_RUNTIME_BIN',
   telegram: 'TELEGRAM_RUNTIME_BIN',
+  voicetalk: 'VOICETALK_RUNTIME_BIN',
 }
 
 /** The PATH-resolvable default launcher name per infra runtime (when no abs path
@@ -97,6 +98,7 @@ export const INFRA_RUNTIME_BIN_ENV: Readonly<Record<string, string>> = {
 export const INFRA_RUNTIME_DEFAULT_BIN: Readonly<Record<string, string>> = {
   notifier: 'notifier-runtime',
   telegram: 'telegram-runtime',
+  voicetalk: 'voicetalk-runtime',
 }
 
 // codex MCP token-free import (contract Установка §codex MCP). codex REFUSES to import

package/src/launch/adapters/voicetalk.ts

@@ -0,0 +1,95 @@
+// voicetalk RuntimeAdapter — the "HOW to launch / observe ONE voicetalk session"
+// half of the launch contract (src/launch/types.ts). Like telegram, voicetalk is a
+// long-running ROUTER (voicetalk-runtime run: mic + wake-word listen → IAP envelopes
+// to the fleet; <iap>-marked stdin → TTS to the owner's speaker), NOT an LLM TUI. So
+// kind:'router' tells launch.launch to SKIP every TUI phase — no pane boot dialog, no
+// ready-marker, no first-user-turn delivery, no activity-proxy ready-gate, no
+// permission modal, no transcript to resume. The pane predicates below are therefore
+// trivial constants, present only to satisfy the frozen interface.
+//
+// voicetalk is a presence-runtime for a HUMAN (the owner's voice channel), modelled on
+// telegram per the foundation presence-runtime contract: kind:'router',
+// usesDoctrine:false, requiresIntelligence:'natural', argv = `<bin> run <extra>`. The
+// STT/TTS engines and providers live in a shared voice service (voice-connect), NOT in
+// this adapter and NOT in the peer passport — interfaces.voicetalk carries only the
+// binding ({wake_word, device}), opaque to the foundation.
+//
+// NO currency on this path: no marketplace check, no plugin install/update — that is
+// install-time (the package self-deploys its runtime.json manifest), not session
+// bring-up.
+
+import type { ControlCommand, ControlPlan, LaunchAdapterConfig, LaunchSpec, RuntimeAdapter } from '../types.ts'
+
+// ─────────────────────────────────────────────────────────────────────────────
+// voicetalkAdapter
+// ─────────────────────────────────────────────────────────────────────────────
+
+export const voicetalkAdapter: RuntimeAdapter = {
+  runtime: 'voicetalk',
+  kind: 'router',
+  usesDoctrine: false,
+
+  /** No submit surface — a router takes no bracketed-paste-then-Enter turn; delivery
+   *  is deliverHosted → child stdin (<iap> reader), not submitIntoTui. Empty glyphs. */
+  deliveryMarkers: { promptGlyphs: [] },
+
+  /**
+   * voicetalk is a HUMAN channel — launch REFUSES a non-natural peer (fail-loud).
+   * Same nature gate as telegram: a peer with intelligence artificial/absent must never
+   * be brought up on voicetalk (it would route the owner's voice channel to an
+   * agent/script). The launch primitive enforces this against LaunchSpec.intelligence;
+   * source of intelligence → docs/Идентичность.
+   */
+  requiresIntelligence: 'natural',
+
+  /**
+   * argv = voicetalkBin + 'run' + extraArgs.
+   *   - cfg.voicetalkBin ?? 'voicetalk-runtime'  the launch binary (the always-on
+   *     plist pins an absolute path via VOICETALK_RUNTIME_BIN — launchd-minimal PATH;
+   *     here we defer to cfg.voicetalkBin when set, else emit the PATH-resolvable
+   *     literal for launch.launch to resolve).
+   *   - 'run'  the router subcommand: reads the peer-profile binding (interfaces.voicetalk),
+   *     brings up mic + wake-word listening, and pumps IAP envelopes both directions
+   *     through the session's stdio (outbound <iap> stdin → TTS; inbound mic → fleet via
+   *     the daemon send_to_peer).
+   *   - ...extraArgs  LaunchSpec.extraArgs passthrough.
+   *
+   * NO --system-prompt-file: usesDoctrine:false — a router is not an LLM, no doctrine to
+   * merge. NO --resume: a router has no transcript. NO currency on this path.
+   */
+  buildArgv(spec: LaunchSpec, cfg: LaunchAdapterConfig): string[] {
+    return [cfg.voicetalkBin ?? 'voicetalk-runtime', 'run', ...(spec.extraArgs ?? [])]
+  },
+
+  /** No startup dialogs — a router has no pane TUI to answer. launch.launch skips the
+   *  boot phase for kind:'router', so this is never consulted; null = "no dialog". */
+  bootDialogKeys(_pane: string): string[] | null {
+    return null
+  },
+
+  /** Always ready: a router has no input surface waiting for a first message — it is
+   *  "up" the instant `voicetalk-runtime run` is launched. launch.launch skips the
+   *  ready-gate for kind:'router'; true = "nothing to wait for". */
+  isInputReady(_pane: string): boolean {
+    return true
+  },
+
+  /** No activity proxy: a router writes no transcript/session jsonl to mtime as a
+   *  ready-gate or idle signal. launch.launch skips the activity-proxy gate for a
+   *  router; null per the contract ("null for a router (no proxy)"). */
+  newestActivityMtime(_cwd: string): number | null {
+    return null
+  },
+
+  /** Nothing to resume: a router does not replay a transcript, so resume cannot
+   *  fail-loud the way claude/codex do. Always {ok:true}. */
+  resolveResume(_cwd: string): { ok: boolean; ref?: string; reason?: string } {
+    return { ok: true }
+  },
+
+  /** No in-session control: a router has no TUI turn to interrupt/compact. null for
+   *  every command → the daemon/CLI surfaces an explicit "unsupported" refusal. */
+  executeControl(_command: ControlCommand): ControlPlan | null {
+    return null
+  },
+}

package/src/launch/index.ts

@@ -23,6 +23,7 @@ import { claudeAdapter } from './adapters/claude.ts'
 import { codexAdapter } from './adapters/codex.ts'
 import { telegramAdapter } from './adapters/telegram.ts'
 import { notifierAdapter } from './adapters/notifier.ts'
+import { voicetalkAdapter } from './adapters/voicetalk.ts'
 import type {
   LaunchConfig,
   LaunchFn,
@@ -88,6 +89,7 @@ export function getAdapter(runtime: Runtime): RuntimeAdapter {
   if (runtime === 'codex') return codexAdapter
   if (runtime === 'telegram') return telegramAdapter
   if (runtime === 'notifier') return notifierAdapter
+  if (runtime === 'voicetalk') return voicetalkAdapter
   throw new Error(`no launch adapter for runtime "${runtime}"`)
 }
 

package/src/launch/launchdRun.ts

@@ -96,6 +96,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
     // (installAlwaysOnPlist) uses — so the pin and the read can never drift.
     telegramBin: env[INFRA_RUNTIME_BIN_ENV.telegram],
     notifierBin: env[INFRA_RUNTIME_BIN_ENV.notifier],
+    voicetalkBin: env[INFRA_RUNTIME_BIN_ENV.voicetalk],
     sockDir,
     bootDeadlineSecs: 30,
     readyGateSecs: 30,

package/src/launch/types.ts

@@ -134,6 +134,8 @@ export interface LaunchAdapterConfig {
   telegramBin?: string
   /** notifier-runtime launch binary (router runtime, infra/always-on). */
   notifierBin?: string
+  /** voicetalk-runtime launch binary (router runtime, infra/always-on — the owner's voice channel). */
+  voicetalkBin?: string
 }
 
 export interface LaunchSpec {

package/src/lifecycle/index.ts

@@ -1246,42 +1246,41 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
       trace({ identity: s.identity, action: 'reaped-gone', death: gone.death, reason: gone.reason, outcome: 'fresh-next-msg' })
       continue
     }
-    // Idle accounting via the runtime adapter's activity proxy (claude transcript
-    // / codex session mtime), FLOORED at wokeAt: a session cannot be idle longer than
-    // it has been awake. A wake that produced no model turn (e.g. an attach-only resume)
-    // leaves the proxy at its PRE-wake value; the old `?? wokeAt` floored only the NULL
-    // case, so a stale-but-non-null proxy (older than this wake) made a freshly-woken
-    // session look idle for its entire prior life → idle-reaped on the very next tick,
-    // out from under an attaching operator. max(), not ??, is the fix — and it still
-    // reaps a session that produced zero further turns (mt=wokeAt → reaped idleSecs
-    // after the wake), and falls back to wokeAt when no adapter exists for the runtime.
-    let mt = s.wokeAt
-    try {
-      mt = Math.max(activityMtime(s.runtime, s.cwd) ?? 0, s.wokeAt)
-    } catch {
-      /* no adapter for this runtime yet → wokeAt baseline */
-    }
+    // Idle accounting via the PANE-LOG (TUI render-stream) mtime — the RELIABLE idle
+    // signal: it advances ~1s while the TUI renders ANY turn (model generation OR a tool
+    // run — the "esc to interrupt" elapsed counter ticks) and goes quiet ONLY at the
+    // prompt. NOT the transcript file mtime: a live claude session RE-TOUCHES its session
+    // .jsonl ~every 30-45min WITHOUT a real turn (a system/bridge re-save), so the
+    // transcript proxy is perpetually < idleSecs and a claude peer NEVER idle-reaps — the
+    // fleet-reap incident: a warm claude pile, last real turn hours ago, never reaped;
+    // codex's session file is NOT re-touched, so codex reaps (the claude-vs-codex split).
+    // The transcript stays the launch ready-gate's signal (it needs "a real turn produced
+    // output"); only this idle proxy moves to the pane-log. FLOORED at wokeAt: a session
+    // cannot be idle longer than it has been awake (a wake that produced no turn →
+    // mt=wokeAt → reaped idleSecs after the wake, never out from under an attaching op).
     const ephemeral = isEphemeralPeer(s.cwd)
-    if (ephemeral) {
-      // FOLD IN the pane-log (TUI render-stream) mtime for ephemeral peers. The transcript
-      // proxy goes QUIET during a long model generation (no JSONL write until the message
-      // completes), so the short ephemeral windows below mis-read mid-generation as "done"
-      // and reap the worker MID-TURN (live incident 2026-06-20: Index reaped age=29s while
-      // generating the next step after a tool_result). The pane-log advances ~1s while the
-      // TUI renders a turn (model generation OR a tool run — the "esc to interrupt" elapsed
-      // counter ticks) and goes quiet only at the prompt, so it is the truer active-turn
-      // signal. max() means "quiet" iff BOTH are silent — it can only DELAY a reap, never
-      // cause an earlier one, so the pipeline serial-drain (idle → quiet → reaped) is
-      // preserved while a working session is never killed mid-turn.
-      const plMt = paneLogMt(s.identity)
-      if (plMt !== null) mt = Math.max(mt, plMt)
+    const plMt = paneLogMt(s.identity)
+    let mt: number
+    if (plMt !== null) {
+      mt = Math.max(plMt, s.wokeAt)
+    } else {
+      // Pane-log MISSING (a legacy pre-pane-log supervisor) → fall back to the transcript
+      // proxy, NEVER to wokeAt-as-activity: a wokeAt-only age would read an ACTIVE legacy
+      // session's idle from its hours-old wokeAt and reap it MID-WORK. The transcript is
+      // false-fresh at idle (so an IDLE legacy peer lingers warm until its next respawn
+      // earns a pane-log — bounded, self-heals), but an ACTIVE legacy peer keeps a
+      // genuinely-fresh transcript and is correctly protected. Safe direction preserved.
+      let tx = 0
+      try { tx = activityMtime(s.runtime, s.cwd) ?? 0 } catch { /* no adapter → wokeAt */ }
+      mt = Math.max(tx, s.wokeAt)
     }
     const ageSecs = Math.floor((nowMs - mt) / 1000)
     // wake_policy:ephemeral M2 — die-after-reply: an ARMED ephemeral session (the
     // daemon routed its outbound reply) is reaped after a QUIET window, checked
-    // BEFORE the idle branch (quiet ≪ idle). Quiet = transcript AND pane-log both
-    // silent for ephemeralQuietSecs — a still-rendering turn keeps the pane-log fresh,
-    // so the worker finishes its turn first; post-reply housekeeping also resets it.
+    // BEFORE the idle branch (quiet ≪ idle). Quiet = the pane-log silent for
+    // ephemeralQuietSecs (the reliable render signal above) — a still-rendering turn
+    // keeps it fresh, so the worker finishes its turn first; post-reply housekeeping
+    // (operative-note writes) also advances it.
     // NOT armed (still mid-task) → the ordinary idle bound below is its only reaper.
     // Deliberate, policy-driven death: NO .idle-reaped (an ephemeral peer never resumes)
     // and NO recordDeath (the crash-loop ring counts faults, not policy reaps).

package/src/runtime/deploy.ts

@@ -32,6 +32,7 @@ import { readRuntimeManifest, type RuntimeManifest, type RuntimePeerDecl } from
 export const RUNTIME_PACKAGES: Readonly<Record<string, string>> = {
   telegram: '@agfpd/telegram-runtime',
   notifier: '@agfpd/notifier-runtime',
+  voicetalk: '@agfpd/voicetalk-runtime',
 }
 
 /** Resolve the npm package for a runtime: explicit override wins, else the built-in