@agfpd/iapeer 0.4.16 → 0.4.18

package/CHANGELOG.md

@@ -10,6 +10,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.18] - 2026-06-22
+
+### Changed
+
+- `iapeer rename <old> <new>` now performs a **full folder rename** (extends 0.4.17's
+  personality-only rename). The personality is a self-healed mirror of `normalize(basename(cwd))`,
+  so a rename that kept the cwd would be reverted by profile-standard self-heal — the folder
+  must move. The verb now atomically moves the cwd folder (the per-cwd profile, `.mcp.json`,
+  native-memory, `CLAUDE.md`, and the `.git` clone ride it), moves the claude transcript slug
+  dir (`~/.claude/projects/<slug>`, keyed by `realpath(cwd)` — so claude history is preserved),
+  and updates the registry cwd + personality + per-cwd profile, with rollback of the fs moves on
+  failure. Best-effort afterwards: re-trust the new cwd for codex + clean the old, rewrite the
+  claude `.mcp.json` identity, purge the old identity's lifecycle markers. Refuses a LIVE peer
+  unless `--force`. Memory (operativka folder + author/index attribution) re-key is the memory
+  provider's separate step; codex resume-history (keyed by the cwd recorded inside each session
+  file, not a path-dir) does not carry to the new cwd.
+
+## [0.4.17] - 2026-06-21
+
+### Added
+
+- `iapeer rename <old> <new>` — first-class peer-identity rename (parity with remove/create).
+  Renames the personality in **both** the registry and the per-cwd profile atomically and
+  **keeps the cwd**, so the claude transcript history (keyed by `realpath(cwd)`) survives.
+  Refuses a LIVE peer unless `--force` (a running session carries the old identity in its
+  env), and purges the old identity's lifecycle markers. Memory re-key (the personality-keyed
+  operativka folder + author/index attribution) is the memory provider's separate step;
+  native-memory is cwd-keyed and unaffected.
+
 ## [0.4.16] - 2026-06-21
 
 ### Fixed
@@ -245,7 +274,9 @@ Initial public release — the foundation core of the iapeer multi-agent ecosyst
 - **Heterogeneous peers** — AI agents (Claude, Codex), humans (Telegram), and services
   (timer = cron, watcher = event) are all first-class and addressed the same way.
 
-[Unreleased]: https://github.com/agfpd/iapeer/compare/v0.4.16...HEAD
+[Unreleased]: https://github.com/agfpd/iapeer/compare/v0.4.18...HEAD
+[0.4.18]: https://github.com/agfpd/iapeer/compare/v0.4.17...v0.4.18
+[0.4.17]: https://github.com/agfpd/iapeer/compare/v0.4.16...v0.4.17
 [0.4.16]: https://github.com/agfpd/iapeer/compare/v0.4.15...v0.4.16
 [0.4.15]: https://github.com/agfpd/iapeer/compare/v0.4.14...v0.4.15
 [0.4.14]: https://github.com/agfpd/iapeer/compare/v0.4.13...v0.4.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.16",
+  "version": "0.4.18",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -11,7 +11,7 @@
 // sentinel-marked always-on plist) are stop/start-able.
 
 import { spawnSync } from 'child_process'
-import { existsSync, readFileSync } from 'fs'
+import { existsSync, readFileSync, renameSync } from 'fs'
 import { fileURLToPath } from 'url'
 import { dirname, join } from 'path'
 import {
@@ -53,7 +53,8 @@ import { getAdapter } from '../launch/index.ts'
 import { hostRunDir } from '../launch/ptyHost.ts' // pty-only: attach via the supervisor client
 import { runSupervisorClient } from '../supervisor/client.ts' // @xterm-free attach client (both reattach port-deps baked in)
 import { cycleDaemon, isFoundationOwnedPlist, launchctlBootstrap, launchdLabel, launchdPlistPath } from '../launch/launchd.ts'
-import { readPeerProfile, resolveCallerIdentity, resolveIdentity, writePeerProfileAtomic } from '../identity/index.ts'
+import { readPeerProfile, renamePeer, resolveCallerIdentity, resolveIdentity, writePeerProfileAtomic } from '../identity/index.ts'
+import { claudeProjectsRoot, transcriptSlug } from '../launch/adapters/claude.ts'
 import { peerProfilePath } from '../storage/index.ts'
 import {
   isConformant,
@@ -827,6 +828,120 @@ export async function removePeerCli(
   }
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// rename — first-class peer-identity rename (parity with remove/create). Wraps
+// renamePeer (registry + per-cwd profile, atomic, inside the lock) and KEEPS the
+// cwd, so the claude transcript history (slug = realpath(cwd)) survives the rename.
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface RenameOutcome {
+  oldPersonality: string
+  newPersonality: string
+  action: 'renamed' | 'absent' | 'target-exists' | 'target-cwd-exists' | 'refused-live'
+  reason?: string
+  oldCwd?: string
+  newCwd?: string
+  transcriptMoved?: boolean
+  purgedState?: string[]
+  sideEffects?: string[]
+}
+
+/**
+ * FULL folder rename of a peer (Arthur's invariant: personality == normalize(basename(cwd)),
+ * a self-healed mirror — so a rename MUST move the folder, or profile-standard self-heal
+ * reverts the personality back to the basename). Atomic core, best-effort side-effects:
+ *  1. mv the cwd folder oldCwd → dirname(oldCwd)/<new> (the per-cwd profile, .mcp.json,
+ *     native-memory, CLAUDE.md, .git all ride it).
+ *  2. mv the claude transcript slug dir (~/.claude/projects/<oldSlug> → <newSlug>) — keyed
+ *     by realpath(cwd), so this is how the claude history is NOT orphaned. (codex history
+ *     is keyed by the cwd recorded INSIDE each ~/.codex/sessions jsonl, not a path-dir, so
+ *     it does NOT carry — a documented limitation; codex starts fresh sessions at the new cwd.)
+ *  3. renamePeer(…, newCwd): atomic registry personality+cwd + per-cwd profile personality.
+ * On any failure in 1-3 the fs moves are rolled back (folder + transcript back). Then
+ * best-effort: codex re-trust the new cwd + clean the old, re-write the claude .mcp.json
+ * identity fallback, purge the old identity's lifecycle markers. Refuses a LIVE peer unless
+ * --force. Does NOT touch memory (operativka/author/index) — the provider re-keys that
+ * separately AFTER this rename; deliberately NO `remove`/unprovision (which would risk a
+ * memory purge). `claudeProjectsDir` is a test seam (default ~/.claude/projects).
+ */
+export async function renamePeerCli(
+  oldPersonality: string,
+  newPersonality: string,
+  opts: CliEnvOptions & { force?: boolean; claudeProjectsDir?: string } = {},
+): Promise<RenameOutcome> {
+  const env = opts.env ?? process.env
+  const index = readPeersIndex({ env })
+  const peer = findPeer(index, oldPersonality)
+  if (!peer) return { oldPersonality, newPersonality, action: 'absent' }
+  if (findPeer(index, newPersonality)) {
+    return { oldPersonality, newPersonality, action: 'target-exists', reason: `"${newPersonality}" already exists` }
+  }
+  const oldCwd = peer.cwd
+  const newCwd = join(dirname(oldCwd), newPersonality)
+  if (existsSync(newCwd)) {
+    return { oldPersonality, newPersonality, action: 'target-cwd-exists', reason: `${newCwd} already exists — move or remove it first` }
+  }
+  const cfg = loadLifecycleConfig(env)
+  if (!opts.force) {
+    const liveRt = peer.runtimes.find(rt => isPeerLive(rt, oldPersonality, cfg.sockDir))
+    if (liveRt) {
+      return {
+        oldPersonality,
+        newPersonality,
+        action: 'refused-live',
+        reason: `"${oldPersonality}" is LIVE on ${liveRt} — its session + folder must be quiescent for the move; stop it first (\`iapeer stop ${oldPersonality}\`) or pass --force`,
+      }
+    }
+  }
+  // ── atomic core (1-3) with rollback ──────────────────────────────────────────
+  const projectsDir = opts.claudeProjectsDir ?? claudeProjectsRoot()
+  const oldSlug = transcriptSlug(oldCwd) // BEFORE the mv — realpath needs the live dir
+  const oldTx = join(projectsDir, oldSlug)
+  renameSync(oldCwd, newCwd) // 1. folder (atomic on one filesystem)
+  let transcriptMoved = false
+  let newTx: string | undefined
+  try {
+    const newSlug = transcriptSlug(newCwd) // AFTER the mv — realpath(newCwd) resolves
+    newTx = join(projectsDir, newSlug)
+    if (oldSlug !== newSlug && existsSync(oldTx) && !existsSync(newTx)) {
+      renameSync(oldTx, newTx) // 2. claude transcript slug dir
+      transcriptMoved = true
+    }
+    await renamePeer(oldPersonality, newPersonality, { env }, newCwd) // 3. atomic registry+profile
+  } catch (e) {
+    if (transcriptMoved && newTx) {
+      try { renameSync(newTx, oldTx) } catch { /* best-effort rollback */ }
+    }
+    try { renameSync(newCwd, oldCwd) } catch { /* best-effort rollback */ }
+    throw e
+  }
+  // ── best-effort side-effects (the core rename already committed) ──────────────
+  const sideEffects: string[] = []
+  if (peer.runtimes.includes('codex')) {
+    try {
+      const { preTrustCodexCwd, removeCodexCwdTrust } = await import('../launch/nativeMemory.ts')
+      preTrustCodexCwd(newCwd, env)
+      removeCodexCwdTrust(oldCwd, env)
+      const { removeCodexHooksTrustUnder } = await import('../launch/codexHooksTrust.ts')
+      removeCodexHooksTrustUnder(oldCwd, env)
+      sideEffects.push('codex-trust: re-trusted new cwd + cleaned old')
+    } catch (e) {
+      sideEffects.push(`codex-trust: failed (${e instanceof Error ? e.message : String(e)})`)
+    }
+  }
+  if (peer.runtimes.includes('claude')) {
+    try {
+      const { writeClaudeMcpConfig, resolveDaemonMcpUrl } = await import('../init/index.ts')
+      writeClaudeMcpConfig(newCwd, newPersonality, resolveDaemonMcpUrl({ env }))
+      sideEffects.push('claude .mcp.json: identity rewritten')
+    } catch (e) {
+      sideEffects.push(`claude .mcp.json: failed (${e instanceof Error ? e.message : String(e)})`)
+    }
+  }
+  const purgedState = peer.runtimes.flatMap(rt => purgeIdentityState(cfg, buildProcessAddress(rt, oldPersonality)))
+  return { oldPersonality, newPersonality, action: 'renamed', oldCwd, newCwd, transcriptMoved, purgedState, sideEffects }
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // send — manual IAP send fallback (contract Примитивы §send). Goes through the
 // same router path as send_to_peer (resolve → deliver / wake), in-process so it
@@ -999,6 +1114,7 @@ const VERBS: ReadonlyArray<{ sig: string; desc: string }> = [
     desc: 'LAZY soft-reload: agentic peer comes up FRESH (re-reads doctrine) on its NEXT natural wake — no kill, no burst-wake; non-agentic runtimes skipped. --all = whole fleet. (eager: `new`/self-fresh)',
   },
   { sig: 'remove <peer> [--force]', desc: 'delete a peer\'s registry record (locked writer); refuses a LIVE peer unless --force' },
+  { sig: 'rename <old> <new> [--force]', desc: 'rename a peer — moves the cwd folder + claude transcript + atomic registry/profile (personality = folder name); refuses a LIVE peer unless --force. Memory re-key is the provider\'s separate step.' },
   {
     sig: 'send <target> (--message <text> | --message-file <f|->) [--from <id>] [--attachment <p>]… [--topic <t>]',
     desc: 'manual IAP send (fallback)',
@@ -1702,6 +1818,29 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         else errOut(`remove: ${o.reason}\n`)
         return o.action === 'refused-live' ? 1 : 0
       }
+      case 'rename': {
+        // FULL folder rename (Arthur's invariant: personality == basename(cwd)): mv the
+        // folder + the claude transcript slug dir + atomic registry cwd+personality, with
+        // rollback; best-effort codex re-trust + .mcp.json rewrite + old-marker purge.
+        // Refuses a LIVE peer unless --force. Memory + codex-history caveats are stated —
+        // a silent data move reads as loss otherwise.
+        if (!positionals[0] || !positionals[1]) {
+          return argErr(errOut, 'rename needs old and new names — usage: iapeer rename <old> <new> [--force]')
+        }
+        const o = await renamePeerCli(positionals[0], positionals[1], { force: flags.force === true, env })
+        if (o.action === 'renamed') {
+          out(`renamed "${o.oldPersonality}" → "${o.newPersonality}"\n`)
+          out(`  folder: ${o.oldCwd} → ${o.newCwd}\n`)
+          out(`  claude transcript: ${o.transcriptMoved ? 'moved (history preserved)' : 'no slug dir to move'}\n`)
+          if (o.sideEffects?.length) out(`  ${o.sideEffects.join('\n  ')}\n`)
+          if (o.purgedState?.length) out(`  lifecycle state purged (old identity): ${o.purgedState.join(', ')}\n`)
+          out(
+            `NOTE: memory (operativka folder + author/index) is personality-keyed — re-key it under "${o.newPersonality}" via the memory provider separately. codex resume-history for the old cwd does NOT carry (codex keys sessions on the in-file cwd). Wake "${o.newPersonality}" to verify identity + history.\n`,
+          )
+        } else if (o.action === 'absent') errOut(`rename: "${o.oldPersonality}" not registered\n`)
+        else errOut(`rename: ${o.reason}\n`)
+        return o.action === 'renamed' ? 0 : 1
+      }
       case 'send': {
         // Message body from EITHER --message <text> OR --message-file <f> (f='-' →
         // stdin). The runtime packages (telegram/notifier) + monitor deliver via

package/src/identity/index.ts

@@ -634,6 +634,7 @@ export async function renamePeer(
   oldPersonality: string,
   newPersonality: string,
   options: PeersUpdateOptions = {},
+  newCwd?: string,
 ): Promise<PeersIndex> {
   if (!isValidName(oldPersonality) || !isValidName(newPersonality)) {
     throw new IapError('peers rename requires valid personalities')
@@ -647,22 +648,30 @@ export async function renamePeer(
     if (index.peers.some(peer => peer.personality === newPersonality)) {
       throw new IapError(`peer "${newPersonality}" already exists`)
     }
-    const sourceProfile = readPeerProfile(target.cwd)
+    // newCwd: the FOLDER was already moved by the caller (the cwd-move rename), so the
+    // profile now lives at newCwd; read/rewrite it THERE and update the registry cwd
+    // pointer atomically with the personality. Omitted → keep-cwd rename (profile at the
+    // registry's current cwd). The folder mv + transcript mv are the caller's side (cli),
+    // done BEFORE this atomic registry write (with rollback on failure).
+    const profileCwd = newCwd ?? target.cwd
+    const sourceProfile = readPeerProfile(profileCwd)
     if (!sourceProfile) {
       throw new IapError(
-        `peer "${oldPersonality}" cwd ${target.cwd} has no ${IAPEER_DIR}/${PEER_PROFILE_FILE}; restore the cwd or remove the registry entry`,
+        `peer "${oldPersonality}" cwd ${profileCwd} has no ${IAPEER_DIR}/${PEER_PROFILE_FILE}; restore the cwd or remove the registry entry`,
       )
     }
     if (sourceProfile.personality !== oldPersonality) {
       throw new IapError(
-        `peer "${oldPersonality}" cwd ${target.cwd} profile has personality "${sourceProfile.personality}", not "${oldPersonality}"; registry out of sync`,
+        `peer "${oldPersonality}" cwd ${profileCwd} profile has personality "${sourceProfile.personality}", not "${oldPersonality}"; registry out of sync`,
       )
     }
-    writePeerProfileAtomic(target.cwd, { ...sourceProfile, personality: newPersonality })
+    writePeerProfileAtomic(profileCwd, { ...sourceProfile, personality: newPersonality })
     return {
       ...index,
       peers: index.peers.map(peer =>
-        peer.personality === oldPersonality ? { ...peer, personality: newPersonality } : peer,
+        peer.personality === oldPersonality
+          ? { ...peer, personality: newPersonality, ...(newCwd ? { cwd: newCwd } : {}) }
+          : peer,
       ),
     }
   }, options)

package/src/launch/adapters/claude.ts

@@ -89,7 +89,7 @@ function anyBootDialog(pane: string): boolean {
  * mkdtemp temp cwd. realpath first so a symlinked cwd maps to the dir claude
  * actually wrote (a stale path falls through to the original string).
  */
-function transcriptSlug(workDir: string): string {
+export function transcriptSlug(workDir: string): string {
   let phys = workDir
   try {
     phys = realpathSync(workDir)
@@ -99,8 +99,15 @@ function transcriptSlug(workDir: string): string {
   return phys.replace(/[^a-zA-Z0-9]/g, '-')
 }
 
-function transcriptDir(workDir: string): string {
-  return join(homedir(), '.claude', 'projects', transcriptSlug(workDir))
+/** The base dir holding all claude project transcript slugs (~/.claude/projects).
+ *  Exported so a cwd-move (peer folder rename) can relocate the slug dir from the
+ *  SINGLE source of the slug encoding, never a re-implementation that could drift. */
+export function claudeProjectsRoot(): string {
+  return join(homedir(), '.claude', 'projects')
+}
+
+export function transcriptDir(workDir: string): string {
+  return join(claudeProjectsRoot(), transcriptSlug(workDir))
 }
 
 // ─────────────────────────────────────────────────────────────────────────────