@agfpd/iapeer 0.4.17 → 0.4.18

package/CHANGELOG.md

@@ -10,6 +10,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.18] - 2026-06-22
+
+### Changed
+
+- `iapeer rename <old> <new>` now performs a **full folder rename** (extends 0.4.17's
+  personality-only rename). The personality is a self-healed mirror of `normalize(basename(cwd))`,
+  so a rename that kept the cwd would be reverted by profile-standard self-heal — the folder
+  must move. The verb now atomically moves the cwd folder (the per-cwd profile, `.mcp.json`,
+  native-memory, `CLAUDE.md`, and the `.git` clone ride it), moves the claude transcript slug
+  dir (`~/.claude/projects/<slug>`, keyed by `realpath(cwd)` — so claude history is preserved),
+  and updates the registry cwd + personality + per-cwd profile, with rollback of the fs moves on
+  failure. Best-effort afterwards: re-trust the new cwd for codex + clean the old, rewrite the
+  claude `.mcp.json` identity, purge the old identity's lifecycle markers. Refuses a LIVE peer
+  unless `--force`. Memory (operativka folder + author/index attribution) re-key is the memory
+  provider's separate step; codex resume-history (keyed by the cwd recorded inside each session
+  file, not a path-dir) does not carry to the new cwd.
+
 ## [0.4.17] - 2026-06-21
 
 ### Added
@@ -257,7 +274,8 @@ Initial public release — the foundation core of the iapeer multi-agent ecosyst
 - **Heterogeneous peers** — AI agents (Claude, Codex), humans (Telegram), and services
   (timer = cron, watcher = event) are all first-class and addressed the same way.
 
-[Unreleased]: https://github.com/agfpd/iapeer/compare/v0.4.17...HEAD
+[Unreleased]: https://github.com/agfpd/iapeer/compare/v0.4.18...HEAD
+[0.4.18]: https://github.com/agfpd/iapeer/compare/v0.4.17...v0.4.18
 [0.4.17]: https://github.com/agfpd/iapeer/compare/v0.4.16...v0.4.17
 [0.4.16]: https://github.com/agfpd/iapeer/compare/v0.4.15...v0.4.16
 [0.4.15]: https://github.com/agfpd/iapeer/compare/v0.4.14...v0.4.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.17",
+  "version": "0.4.18",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -11,7 +11,7 @@
 // sentinel-marked always-on plist) are stop/start-able.
 
 import { spawnSync } from 'child_process'
-import { existsSync, readFileSync } from 'fs'
+import { existsSync, readFileSync, renameSync } from 'fs'
 import { fileURLToPath } from 'url'
 import { dirname, join } from 'path'
 import {
@@ -54,6 +54,7 @@ import { hostRunDir } from '../launch/ptyHost.ts' // pty-only: attach via the su
 import { runSupervisorClient } from '../supervisor/client.ts' // @xterm-free attach client (both reattach port-deps baked in)
 import { cycleDaemon, isFoundationOwnedPlist, launchctlBootstrap, launchdLabel, launchdPlistPath } from '../launch/launchd.ts'
 import { readPeerProfile, renamePeer, resolveCallerIdentity, resolveIdentity, writePeerProfileAtomic } from '../identity/index.ts'
+import { claudeProjectsRoot, transcriptSlug } from '../launch/adapters/claude.ts'
 import { peerProfilePath } from '../storage/index.ts'
 import {
   isConformant,
@@ -836,27 +837,37 @@ export async function removePeerCli(
 export interface RenameOutcome {
   oldPersonality: string
   newPersonality: string
-  action: 'renamed' | 'absent' | 'target-exists' | 'refused-live'
+  action: 'renamed' | 'absent' | 'target-exists' | 'target-cwd-exists' | 'refused-live'
   reason?: string
-  cwd?: string
+  oldCwd?: string
+  newCwd?: string
+  transcriptMoved?: boolean
   purgedState?: string[]
+  sideEffects?: string[]
 }
 
 /**
- * Rename a peer's personality through renamePeer (registry + per-cwd profile, atomic;
- * cwd KEPT — the transcript history keyed by slug=realpath(cwd) survives). Refuses a LIVE
- * peer unless --force: a running session carries the OLD identity in its env
- * (PEER_PERSONALITY, set at launch), so renaming under it desyncs the registry from the
- * live process — stop it first, it respawns under the new identity. Purges the OLD
- * identity-keyed lifecycle markers (remove-parity) so a future namesake can't inherit
- * them. Does NOT move memory: the operativka folder + author/index attribution are
- * personality-keyed (the memory provider re-keys them separately); native-memory is
- * cwd-keyed and rides the kept cwd unchanged.
+ * FULL folder rename of a peer (Arthur's invariant: personality == normalize(basename(cwd)),
+ * a self-healed mirror — so a rename MUST move the folder, or profile-standard self-heal
+ * reverts the personality back to the basename). Atomic core, best-effort side-effects:
+ *  1. mv the cwd folder oldCwd → dirname(oldCwd)/<new> (the per-cwd profile, .mcp.json,
+ *     native-memory, CLAUDE.md, .git all ride it).
+ *  2. mv the claude transcript slug dir (~/.claude/projects/<oldSlug> → <newSlug>) — keyed
+ *     by realpath(cwd), so this is how the claude history is NOT orphaned. (codex history
+ *     is keyed by the cwd recorded INSIDE each ~/.codex/sessions jsonl, not a path-dir, so
+ *     it does NOT carry — a documented limitation; codex starts fresh sessions at the new cwd.)
+ *  3. renamePeer(…, newCwd): atomic registry personality+cwd + per-cwd profile personality.
+ * On any failure in 1-3 the fs moves are rolled back (folder + transcript back). Then
+ * best-effort: codex re-trust the new cwd + clean the old, re-write the claude .mcp.json
+ * identity fallback, purge the old identity's lifecycle markers. Refuses a LIVE peer unless
+ * --force. Does NOT touch memory (operativka/author/index) — the provider re-keys that
+ * separately AFTER this rename; deliberately NO `remove`/unprovision (which would risk a
+ * memory purge). `claudeProjectsDir` is a test seam (default ~/.claude/projects).
  */
 export async function renamePeerCli(
   oldPersonality: string,
   newPersonality: string,
-  opts: CliEnvOptions & { force?: boolean } = {},
+  opts: CliEnvOptions & { force?: boolean; claudeProjectsDir?: string } = {},
 ): Promise<RenameOutcome> {
   const env = opts.env ?? process.env
   const index = readPeersIndex({ env })
@@ -865,6 +876,11 @@ export async function renamePeerCli(
   if (findPeer(index, newPersonality)) {
     return { oldPersonality, newPersonality, action: 'target-exists', reason: `"${newPersonality}" already exists` }
   }
+  const oldCwd = peer.cwd
+  const newCwd = join(dirname(oldCwd), newPersonality)
+  if (existsSync(newCwd)) {
+    return { oldPersonality, newPersonality, action: 'target-cwd-exists', reason: `${newCwd} already exists — move or remove it first` }
+  }
   const cfg = loadLifecycleConfig(env)
   if (!opts.force) {
     const liveRt = peer.runtimes.find(rt => isPeerLive(rt, oldPersonality, cfg.sockDir))
@@ -873,13 +889,57 @@ export async function renamePeerCli(
         oldPersonality,
         newPersonality,
         action: 'refused-live',
-        reason: `"${oldPersonality}" is LIVE on ${liveRt} — its running session carries the old identity in its env; stop it first (\`iapeer stop ${oldPersonality}\`) or pass --force`,
+        reason: `"${oldPersonality}" is LIVE on ${liveRt} — its session + folder must be quiescent for the move; stop it first (\`iapeer stop ${oldPersonality}\`) or pass --force`,
       }
     }
   }
-  await renamePeer(oldPersonality, newPersonality, { env })
+  // ── atomic core (1-3) with rollback ──────────────────────────────────────────
+  const projectsDir = opts.claudeProjectsDir ?? claudeProjectsRoot()
+  const oldSlug = transcriptSlug(oldCwd) // BEFORE the mv — realpath needs the live dir
+  const oldTx = join(projectsDir, oldSlug)
+  renameSync(oldCwd, newCwd) // 1. folder (atomic on one filesystem)
+  let transcriptMoved = false
+  let newTx: string | undefined
+  try {
+    const newSlug = transcriptSlug(newCwd) // AFTER the mv — realpath(newCwd) resolves
+    newTx = join(projectsDir, newSlug)
+    if (oldSlug !== newSlug && existsSync(oldTx) && !existsSync(newTx)) {
+      renameSync(oldTx, newTx) // 2. claude transcript slug dir
+      transcriptMoved = true
+    }
+    await renamePeer(oldPersonality, newPersonality, { env }, newCwd) // 3. atomic registry+profile
+  } catch (e) {
+    if (transcriptMoved && newTx) {
+      try { renameSync(newTx, oldTx) } catch { /* best-effort rollback */ }
+    }
+    try { renameSync(newCwd, oldCwd) } catch { /* best-effort rollback */ }
+    throw e
+  }
+  // ── best-effort side-effects (the core rename already committed) ──────────────
+  const sideEffects: string[] = []
+  if (peer.runtimes.includes('codex')) {
+    try {
+      const { preTrustCodexCwd, removeCodexCwdTrust } = await import('../launch/nativeMemory.ts')
+      preTrustCodexCwd(newCwd, env)
+      removeCodexCwdTrust(oldCwd, env)
+      const { removeCodexHooksTrustUnder } = await import('../launch/codexHooksTrust.ts')
+      removeCodexHooksTrustUnder(oldCwd, env)
+      sideEffects.push('codex-trust: re-trusted new cwd + cleaned old')
+    } catch (e) {
+      sideEffects.push(`codex-trust: failed (${e instanceof Error ? e.message : String(e)})`)
+    }
+  }
+  if (peer.runtimes.includes('claude')) {
+    try {
+      const { writeClaudeMcpConfig, resolveDaemonMcpUrl } = await import('../init/index.ts')
+      writeClaudeMcpConfig(newCwd, newPersonality, resolveDaemonMcpUrl({ env }))
+      sideEffects.push('claude .mcp.json: identity rewritten')
+    } catch (e) {
+      sideEffects.push(`claude .mcp.json: failed (${e instanceof Error ? e.message : String(e)})`)
+    }
+  }
   const purgedState = peer.runtimes.flatMap(rt => purgeIdentityState(cfg, buildProcessAddress(rt, oldPersonality)))
-  return { oldPersonality, newPersonality, action: 'renamed', cwd: peer.cwd, purgedState }
+  return { oldPersonality, newPersonality, action: 'renamed', oldCwd, newCwd, transcriptMoved, purgedState, sideEffects }
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -1054,7 +1114,7 @@ const VERBS: ReadonlyArray<{ sig: string; desc: string }> = [
     desc: 'LAZY soft-reload: agentic peer comes up FRESH (re-reads doctrine) on its NEXT natural wake — no kill, no burst-wake; non-agentic runtimes skipped. --all = whole fleet. (eager: `new`/self-fresh)',
   },
   { sig: 'remove <peer> [--force]', desc: 'delete a peer\'s registry record (locked writer); refuses a LIVE peer unless --force' },
-  { sig: 'rename <old> <new> [--force]', desc: 'rename a peer\'s personality (registry + per-cwd profile, atomic; cwd/transcript-history kept); refuses a LIVE peer unless --force. Memory re-key is the provider\'s separate step.' },
+  { sig: 'rename <old> <new> [--force]', desc: 'rename a peer — moves the cwd folder + claude transcript + atomic registry/profile (personality = folder name); refuses a LIVE peer unless --force. Memory re-key is the provider\'s separate step.' },
   {
     sig: 'send <target> (--message <text> | --message-file <f|->) [--from <id>] [--attachment <p>]… [--topic <t>]',
     desc: 'manual IAP send (fallback)',
@@ -1759,19 +1819,23 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         return o.action === 'refused-live' ? 1 : 0
       }
       case 'rename': {
-        // Rename a peer's personality (registry + per-cwd profile, atomic; cwd KEPT so
-        // the transcript history survives). Refuses a LIVE peer unless --force. Memory
-        // (operativka folder + author/index) is personality-keyed and re-keyed separately
-        // by the provider — say so, or it reads as a silent data loss.
+        // FULL folder rename (Arthur's invariant: personality == basename(cwd)): mv the
+        // folder + the claude transcript slug dir + atomic registry cwd+personality, with
+        // rollback; best-effort codex re-trust + .mcp.json rewrite + old-marker purge.
+        // Refuses a LIVE peer unless --force. Memory + codex-history caveats are stated —
+        // a silent data move reads as loss otherwise.
         if (!positionals[0] || !positionals[1]) {
           return argErr(errOut, 'rename needs old and new names — usage: iapeer rename <old> <new> [--force]')
         }
         const o = await renamePeerCli(positionals[0], positionals[1], { force: flags.force === true, env })
         if (o.action === 'renamed') {
-          out(`renamed "${o.oldPersonality}" → "${o.newPersonality}" (registry + per-cwd profile; cwd kept: ${o.cwd})\n`)
-          if (o.purgedState?.length) out(`lifecycle state purged (old identity): ${o.purgedState.join(', ')}\n`)
+          out(`renamed "${o.oldPersonality}" → "${o.newPersonality}"\n`)
+          out(`  folder: ${o.oldCwd} → ${o.newCwd}\n`)
+          out(`  claude transcript: ${o.transcriptMoved ? 'moved (history preserved)' : 'no slug dir to move'}\n`)
+          if (o.sideEffects?.length) out(`  ${o.sideEffects.join('\n  ')}\n`)
+          if (o.purgedState?.length) out(`  lifecycle state purged (old identity): ${o.purgedState.join(', ')}\n`)
           out(
-            `NOTE: memory is NOT moved by rename — re-key the operativka folder + author/index attribution under "${o.newPersonality}" via the memory provider (native-memory rides the kept cwd, unchanged). Wake "${o.newPersonality}" to verify identity + history.\n`,
+            `NOTE: memory (operativka folder + author/index) is personality-keyed — re-key it under "${o.newPersonality}" via the memory provider separately. codex resume-history for the old cwd does NOT carry (codex keys sessions on the in-file cwd). Wake "${o.newPersonality}" to verify identity + history.\n`,
           )
         } else if (o.action === 'absent') errOut(`rename: "${o.oldPersonality}" not registered\n`)
         else errOut(`rename: ${o.reason}\n`)

package/src/identity/index.ts

@@ -634,6 +634,7 @@ export async function renamePeer(
   oldPersonality: string,
   newPersonality: string,
   options: PeersUpdateOptions = {},
+  newCwd?: string,
 ): Promise<PeersIndex> {
   if (!isValidName(oldPersonality) || !isValidName(newPersonality)) {
     throw new IapError('peers rename requires valid personalities')
@@ -647,22 +648,30 @@ export async function renamePeer(
     if (index.peers.some(peer => peer.personality === newPersonality)) {
       throw new IapError(`peer "${newPersonality}" already exists`)
     }
-    const sourceProfile = readPeerProfile(target.cwd)
+    // newCwd: the FOLDER was already moved by the caller (the cwd-move rename), so the
+    // profile now lives at newCwd; read/rewrite it THERE and update the registry cwd
+    // pointer atomically with the personality. Omitted → keep-cwd rename (profile at the
+    // registry's current cwd). The folder mv + transcript mv are the caller's side (cli),
+    // done BEFORE this atomic registry write (with rollback on failure).
+    const profileCwd = newCwd ?? target.cwd
+    const sourceProfile = readPeerProfile(profileCwd)
     if (!sourceProfile) {
       throw new IapError(
-        `peer "${oldPersonality}" cwd ${target.cwd} has no ${IAPEER_DIR}/${PEER_PROFILE_FILE}; restore the cwd or remove the registry entry`,
+        `peer "${oldPersonality}" cwd ${profileCwd} has no ${IAPEER_DIR}/${PEER_PROFILE_FILE}; restore the cwd or remove the registry entry`,
       )
     }
     if (sourceProfile.personality !== oldPersonality) {
       throw new IapError(
-        `peer "${oldPersonality}" cwd ${target.cwd} profile has personality "${sourceProfile.personality}", not "${oldPersonality}"; registry out of sync`,
+        `peer "${oldPersonality}" cwd ${profileCwd} profile has personality "${sourceProfile.personality}", not "${oldPersonality}"; registry out of sync`,
       )
     }
-    writePeerProfileAtomic(target.cwd, { ...sourceProfile, personality: newPersonality })
+    writePeerProfileAtomic(profileCwd, { ...sourceProfile, personality: newPersonality })
     return {
       ...index,
       peers: index.peers.map(peer =>
-        peer.personality === oldPersonality ? { ...peer, personality: newPersonality } : peer,
+        peer.personality === oldPersonality
+          ? { ...peer, personality: newPersonality, ...(newCwd ? { cwd: newCwd } : {}) }
+          : peer,
       ),
     }
   }, options)

package/src/launch/adapters/claude.ts

@@ -89,7 +89,7 @@ function anyBootDialog(pane: string): boolean {
  * mkdtemp temp cwd. realpath first so a symlinked cwd maps to the dir claude
  * actually wrote (a stale path falls through to the original string).
  */
-function transcriptSlug(workDir: string): string {
+export function transcriptSlug(workDir: string): string {
   let phys = workDir
   try {
     phys = realpathSync(workDir)
@@ -99,8 +99,15 @@ function transcriptSlug(workDir: string): string {
   return phys.replace(/[^a-zA-Z0-9]/g, '-')
 }
 
-function transcriptDir(workDir: string): string {
-  return join(homedir(), '.claude', 'projects', transcriptSlug(workDir))
+/** The base dir holding all claude project transcript slugs (~/.claude/projects).
+ *  Exported so a cwd-move (peer folder rename) can relocate the slug dir from the
+ *  SINGLE source of the slug encoding, never a re-implementation that could drift. */
+export function claudeProjectsRoot(): string {
+  return join(homedir(), '.claude', 'projects')
+}
+
+export function transcriptDir(workDir: string): string {
+  return join(claudeProjectsRoot(), transcriptSlug(workDir))
 }
 
 // ─────────────────────────────────────────────────────────────────────────────