@agfpd/iapeer 0.4.19 → 0.4.21

package/CHANGELOG.md

@@ -10,6 +10,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.21] - 2026-06-22
+
+### Fixed
+
+- **`iapeer remove` of an always-on peer no longer leaves an orphan launchd plist.** An
+  infra peer (notifier/telegram/voicetalk) has a `com.iapeer.<p>` plist with KeepAlive;
+  `remove` dropped only the registry record, so launchd kept relaunching `iapeer run-infra
+  <p> <rt>` against the now-deleted record → crash-loop (the SRE peer alerted
+  "gone-without-disable"). `remove` now boots out + removes the **foundation-owned** plist
+  BEFORE the registry remove (closing the crash-loop window), and the **H4 fleet-guard**
+  refuses a FOREIGN persistent-peer plist (`--force` drops only the registry record and
+  leaves the foreign plist intact). A warm peer (no plist) is unaffected.
+
+## [0.4.20] - 2026-06-22
+
+### Fixed
+
+- **Codex hosted-delivery no longer false-fails.** The warm-delivery landing-confirm
+  (`deliverViaHost`) confirmed a message "landed" only by a transcript/session-jsonl mtime
+  advance within a 3000ms grace. Claude writes the user turn to its transcript promptly, but
+  **codex writes its session jsonl only at model-turn-start** (gated by time-to-first-token,
+  ~4-6s after submit) — so every codex delivery structurally false-failed with `"no transcript
+  advance within 3000ms"` even though the message landed and codex was processing it (proven in
+  delivery.log: an `ok=false` immediately followed by codex recording the input and replying).
+  The confirm now also accepts a **pane-log (TUI render-stream) mtime advance** — the same true
+  active-turn signal the 0.4.16 idle-reap fix uses; it ticks ~1s as the session renders the
+  working state on submit, giving codex delivery parity with claude without lengthening the
+  (synchronous) grace. An advance proves the session is alive and reacted to the just-flushed
+  bytes (a dead/wedged pty renders nothing → still fails correctly). The typing/tool-use
+  indicator for codex is a separate telegram-runtime concern (its pane-log parsing).
+
 ## [0.4.19] - 2026-06-22
 
 ### Added
@@ -294,7 +325,9 @@ Initial public release — the foundation core of the iapeer multi-agent ecosyst
 - **Heterogeneous peers** — AI agents (Claude, Codex), humans (Telegram), and services
   (timer = cron, watcher = event) are all first-class and addressed the same way.
 
-[Unreleased]: https://github.com/agfpd/iapeer/compare/v0.4.19...HEAD
+[Unreleased]: https://github.com/agfpd/iapeer/compare/v0.4.21...HEAD
+[0.4.21]: https://github.com/agfpd/iapeer/compare/v0.4.20...v0.4.21
+[0.4.20]: https://github.com/agfpd/iapeer/compare/v0.4.19...v0.4.20
 [0.4.19]: https://github.com/agfpd/iapeer/compare/v0.4.18...v0.4.19
 [0.4.18]: https://github.com/agfpd/iapeer/compare/v0.4.17...v0.4.18
 [0.4.17]: https://github.com/agfpd/iapeer/compare/v0.4.16...v0.4.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.19",
+  "version": "0.4.21",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -11,7 +11,7 @@
 // sentinel-marked always-on plist) are stop/start-able.
 
 import { spawnSync } from 'child_process'
-import { existsSync, readFileSync, renameSync } from 'fs'
+import { existsSync, readFileSync, renameSync, rmSync } from 'fs'
 import { fileURLToPath } from 'url'
 import { dirname, join } from 'path'
 import {
@@ -693,8 +693,13 @@ export async function compactPeer(
 
 export interface RemoveOutcome {
   personality: string
-  action: 'removed' | 'absent' | 'refused-live'
+  action: 'removed' | 'absent' | 'refused-live' | 'refused-foreign-launchd'
   reason?: string
+  /** Always-on plist teardown outcome (`bootout + plist removed` / `skipped-sandbox` /
+   *  `skipped-foreign …`). Present only when the peer had a com.iapeer.<p> plist — an
+   *  always-on (infra) peer. Without this, remove orphaned the loaded plist → launchd
+   *  KeepAlive crash-looped `run-infra` against the deleted record. */
+  plistTeardown?: string
   /** The removed peer's cwd (registry fact, captured BEFORE the removal). remove
    *  deliberately keeps the folder — user data is never deleted by a registry reap
    *  (say so in the output instead of leaving silent orphans). */
@@ -744,6 +749,47 @@ export async function removePeerCli(
       }
     }
   }
+  // PLIST TEARDOWN (the always-on / launchd-managed peer). An infra peer
+  // (notifier/telegram/voicetalk) has a com.iapeer.<p> plist with KeepAlive. Removing
+  // ONLY the registry record leaves the plist LOADED → launchd keeps relaunching
+  // `iapeer run-infra <p> <rt>` against the now-deleted record → CRASH-LOOP (doc alerts
+  // "gone-without-disable"). So bootout the job BEFORE the registry remove (stop KeepAlive
+  // before its target vanishes — no crash-loop window), then rm the plist file.
+  // FLEET GUARD (H4): a FOREIGN persistent-peer plist is off-limits — refuse (unless
+  // --force, which then drops ONLY the registry record and leaves the foreign plist intact).
+  let plistTeardown: string | undefined
+  if (isLaunchdManaged(personality, env)) {
+    if (isForeignLaunchd(personality, env)) {
+      if (!opts.force) {
+        return {
+          personality,
+          action: 'refused-foreign-launchd',
+          reason: `"${personality}" is managed by persistent-peer (foreign launchd plist) — the foundation will not remove it (H4). Use persistent-peer tooling, or --force to drop ONLY the registry record (the foreign plist is left intact).`,
+        }
+      }
+      plistTeardown = 'skipped-foreign (H4 — foreign plist left intact; --force dropped only the registry record)'
+    } else {
+      const plistPath = launchdPlistPath(personality, env)
+      // Sandbox/test: never invoke real launchctl (a test peer's label isn't a real job);
+      // still remove the (temp-dir) plist file so the teardown is observable.
+      let bootoutNote: string
+      if (env.IAPEER_TEST_SANDBOX === '1') {
+        bootoutNote = 'skipped-sandbox'
+      } else {
+        const r = spawnSync('launchctl', ['bootout', `gui/${uid()}/${launchdLabel(personality)}`], { encoding: 'utf8' })
+        // bootout exits non-zero when the job was already unloaded — benign for a teardown.
+        bootoutNote = r.status === 0 ? 'bootout' : `bootout (exit ${r.status}${(r.stderr ?? '').trim() ? `: ${(r.stderr ?? '').trim()}` : ''})`
+      }
+      let rmNote: string
+      try {
+        rmSync(plistPath, { force: true })
+        rmNote = ' + plist removed'
+      } catch (e) {
+        rmNote = ` (plist rm FAILED: ${e instanceof Error ? e.message : String(e)} — remove ${plistPath} manually)`
+      }
+      plistTeardown = `${bootoutNote}${rmNote}`
+    }
+  }
   await removePeer(personality, { env })
   // v1.2 UNPROVISION joint (контракт §Provision провайдера): a provision-declaring
   // slot gets its unprovision command per agentic runtime with occasion=remove —
@@ -822,6 +868,7 @@ export async function removePeerCli(
     action: 'removed',
     cwd: peer.cwd,
     purgedState,
+    ...(plistTeardown ? { plistTeardown } : {}),
     ...(unprovisionOutcomes.length ? { unprovision: unprovisionOutcomes } : {}),
     ...(trustCleaned ? { codexTrust: trustCleaned } : {}),
     ...(hooksTrustCleaned ? { codexHooksTrust: hooksTrustCleaned } : {}),
@@ -1806,6 +1853,11 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         const o = await removePeerCli(positionals[0], { force: flags.force === true, env })
         if (o.action === 'removed') {
           out(`removed "${o.personality}" from the registry\n`)
+          // Always-on plist teardown (bootout + rm) — an orphan loaded plist would
+          // KeepAlive-crash-loop run-infra against the deleted record.
+          if (o.plistTeardown) {
+            out(`launchd plist: ${o.plistTeardown}\n`)
+          }
           // v1.2: the provider unwound its surfaces (occasion=remove) — say how it went.
           if (o.unprovision?.length) {
             out(`memory unprovision: ${o.unprovision.join(', ')}\n`)
@@ -1830,7 +1882,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
           }
         } else if (o.action === 'absent') out(`"${o.personality}" not registered — no-op\n`)
         else errOut(`remove: ${o.reason}\n`)
-        return o.action === 'refused-live' ? 1 : 0
+        return o.action === 'refused-live' || o.action === 'refused-foreign-launchd' ? 1 : 0
       }
       case 'rename': {
         // FULL folder rename (Arthur's invariant: personality == basename(cwd)): mv the

package/src/transport/index.ts

@@ -33,6 +33,7 @@ import {
   type ProcessAddress,
 } from '../core/socket.ts'
 import { buildEnvelope } from '../codec/index.ts'
+import { resolveGlobalRoot } from '../storage/index.ts'
 import { findPeer, readPeersIndex, type PeerRecord } from '../registry/index.ts'
 import type { ResolvedCaller } from '../identity/index.ts'
 // Delivery markers are OWNED by the runtime adapter. transport
@@ -185,6 +186,12 @@ export interface WarmDeliverSeam {
   deliverHosted?: (identity: string, envelope: string) => Promise<DeliverResult>
   /** Activity proxy for the landed-confirm. Default: the target runtime adapter's transcript mtime. */
   newestActivityMtime?: (cwd: string) => number | null
+  /** SECOND landed-confirm proxy: the pane-log (TUI render-stream) mtime, keyed by process
+   *  ADDRESS. Default: the real `<root>/logs/lifecycle/<address>.log` mtime. The pane-log ticks
+   *  ~1s as the session renders its working state on submit — for codex it advances ~1s while the
+   *  session-jsonl only advances at model-turn-start (~4-6s, past the grace), so this is the signal
+   *  that gives codex delivery parity. See `deliverViaHost`. */
+  paneLogMtime?: (address: string) => number | null
 }
 
 /**
@@ -211,9 +218,12 @@ async function deliverViaHost(
 ): Promise<Result<void>> {
   const adapter = getAdapter(target.runtime)
   const mtimeOf = seam.newestActivityMtime ?? ((c: string) => adapter.newestActivityMtime(c))
-  // Baseline the activity proxy BEFORE delivery (a paste/CR does not move the transcript — only a
-  // model turn does), so an advance afterwards proves the session is alive and took our message.
+  const paneMtimeOf = seam.paneLogMtime ?? ((addr: string) => defaultPaneLogMtime(addr))
+  // Baseline BOTH landed-proxies BEFORE delivery (a paste/CR does not move the transcript — only a
+  // model turn does; the pane-log moves as the session renders), so an advance in EITHER afterwards
+  // proves the session is alive and took our message.
   const baseline = cwd ? mtimeOf(cwd) ?? 0 : 0
+  const paneBaseline = paneMtimeOf(target.address) ?? 0
   const send = seam.deliverHosted ?? deliverHosted
   const sent = await send(target.address, envelope)
   if (!sent.ok) {
@@ -232,22 +242,43 @@ async function deliverViaHost(
   // socket-ack ≠ landed. With no activity proxy (direct callers/tests without a cwd) we can only
   // trust the flushed submit — confirmed-only, mirroring deliverViaTmux's legacy-caller path.
   if (!cwd) return ok(undefined)
-  // Confirm landing by the SAME final arbiter as the tmux busy path: a transcript-mtime advance.
-  // Grace-poll the proxy (the model may take a beat to write its turn); a hosted session has no
-  // input-clear fast path (no capture-pane), so this is the SOLE confirm. Prefer a false-FAIL
-  // (sender retries) over a false-OK (silent loss, forbidden).
+  // Confirm landing by EITHER of two proxies within the grace:
+  //  (a) transcript/session-jsonl mtime advance — the strong "model wrote a turn" signal. claude
+  //      writes the user turn to its transcript promptly (sub-second); CODEX writes its session
+  //      jsonl only at model-turn-START (gated by TTFT, measured ~4-6s after submit), so on the
+  //      transcript-ONLY confirm every codex delivery STRUCTURALLY false-FAILED (the 3000ms grace
+  //      expires before the first session write — proven in delivery.log).
+  //  (b) PANE-LOG (TUI render-stream) mtime advance — the SAME true active-turn signal the 0.4.16
+  //      idle-reap fix uses: it ticks ~1s as the session renders the working state on submit, so it
+  //      catches codex in ~1s, giving codex delivery parity with claude WITHOUT lengthening the
+  //      (synchronous) grace. NOT a false-OK: an advance proves the session is alive and rendered
+  //      output in response to our just-flushed bytes (a wedged/dead pty renders nothing → no
+  //      advance → correct fail); the bytes are then in the session's input (codex queues input
+  //      during a turn). Prefer a false-FAIL (sender retries) over a false-OK (silent loss).
   const graceMs = hostLivenessGraceMs()
   const graceDeadline = monotonicMs() + graceMs
   do {
     if ((mtimeOf(cwd) ?? 0) > baseline) return ok(undefined)
+    if ((paneMtimeOf(target.address) ?? 0) > paneBaseline) return ok(undefined)
     sleepSync(LIVENESS_POLL_MS)
   } while (monotonicMs() < graceDeadline)
   return err(
     `hosted peer "${target.personality}" (${target.runtime}) is listed live but did not accept the message ` +
-      `(no transcript advance within ${graceMs}ms) — live but unresponsive to this delivery (not dead); message NOT delivered`,
+      `(no transcript or pane-log advance within ${graceMs}ms) — live but unresponsive to this delivery (not dead); message NOT delivered`,
   )
 }
 
+/** Pane-log (TUI render-stream) mtime for a process address, or null when absent/unreadable.
+ *  The pane-log is the canonical `<root>/logs/lifecycle/<address>.log` the supervisor appends raw
+ *  pty bytes to (§1 contract). Used as the SECOND landed-confirm proxy in deliverViaHost. */
+function defaultPaneLogMtime(address: string): number | null {
+  try {
+    return statSync(join(resolveGlobalRoot(), 'logs', 'lifecycle', `${address}.log`)).mtimeMs
+  } catch {
+    return null
+  }
+}
+
 
 // ─── Compact done gate (dialogue control must report FACT, not keystroke delivery) ──