@agfpd/iapeer 0.4.29 → 0.4.31

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.29",
+  "version": "0.4.31",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/launch/adapters/claude.ts

@@ -136,6 +136,11 @@ export const claudeAdapter: RuntimeAdapter = {
     ghostTextSgr: ['2', '38;5;246'],
   },
 
+  // claude logs an accepted paste PROMPTLY (sub-second: a queue-operation when busy,
+  // the user-turn when idle), so the message-specific transcript confirm is both cheap
+  // and a swallow-guard (the false-OK class). Keep it. (See RuntimeAdapter.deliveryConfirm.)
+  deliveryConfirm: 'transcript',
+
   /**
    * argv = claudeBin + headless flags + (system-prompt-file when set) +
    * (--continue when resuming) + extraArgs.

package/src/launch/adapters/codex.ts

@@ -177,6 +177,16 @@ export const codexAdapter: RuntimeAdapter = {
     ghostTextSgr: ['2', '38;5;246'],
   },
 
+  // codex writes NO prompt-acceptance record — its session-jsonl user-input appears only
+  // when the model TURN ingests the message (during a long turn, tens of seconds away;
+  // measured ~80s live 2026-06-25). But its input queue is DURABLE: a mid-turn submit is
+  // held and processed at the next turn boundary, never lost (verified live — an 80s turn
+  // still ingested + replied with the exact probe token, despite the send false-FAILing at
+  // the 8s grace). So the flushed socket-ack IS the delivery confirm; a transcript grace
+  // only false-FAILs a message that WILL be processed → wrong fallback escalation. A
+  // genuinely dead session still fails at the socket-ack. (See RuntimeAdapter.deliveryConfirm.)
+  deliveryConfirm: 'socket-ack',
+
   /**
    * argv = codexBin + (resume --last when spec.resume) + the TUI args +
    * (doctrine via -c when systemPromptFile set) + bypass + extraArgs. Order is

package/src/launch/adapters/transcriptTail.ts

@@ -11,12 +11,24 @@ import { openSync, readSync, closeSync, statSync } from 'fs'
 
 /**
  * Content-timestamp (epoch ms) of the LAST jsonl entry carrying a `timestamp` field, read from the
- * file's TAIL (cheap — only the last `tailBytes` are read). Metadata records without a `timestamp`
- * (claude `mode` / `ai-title` / `bridge-session`) are skipped. Returns null when the file is
- * unreadable or no timestamped entry sits in the tail (the caller then floors at wokeAt). A partial
- * FIRST line in the tail buffer is harmless: we scan from the END and return on the first complete
- * timestamped entry, so a truncated leading line is only ever reached (and skipped) when nothing
- * matched.
+ * file's TAIL. Metadata records without a `timestamp` (claude `mode` / `ai-title` / `bridge-session`)
+ * are skipped. Returns null only when the file is unreadable / empty, or genuinely carries NO
+ * timestamped entry anywhere (the caller then floors at wokeAt).
+ *
+ * ADAPTIVE WINDOW (the giant-tail fix). The reader starts at the cheap `tailBytes` window and GROWS it
+ * (doubling, capped at file size) until a complete timestamped entry is captured. A single transcript
+ * record can dwarf the default window — a browser peer appends base64 screenshots, observed up to
+ * 368 KB (5.6× the 64 KB default). When such a record is the tail, a FIXED window holds only a fragment
+ * of one line: no complete JSON → the old code returned null, the caller floored at wokeAt, and a LIVE
+ * working session was idle-reaped (incident: mrbrowser killed mid-task, last turn 7 s before the reap).
+ * Growing guarantees we eventually read the full last record (worst case: the entire file), so a present
+ * timestamp is NEVER missed. The default window already covers the common case in one read; growth only
+ * kicks in for oversized tail records, and even then is bounded (≈log2(fileSize/tailBytes) reads).
+ *
+ * A partial LEADING line is never trusted: once the window starts past byte 0, the first split segment
+ * may be the truncated tail of an earlier record (which could mis-parse as valid JSON), so we scan only
+ * the newline-bounded segments after it. Reaching byte 0 makes every segment complete, including the
+ * first — and terminates the growth.
  */
 export function lastTimestampedEntryMs(path: string, tailBytes = 65536): number | null {
   let fd: number
@@ -27,35 +39,45 @@ export function lastTimestampedEntryMs(path: string, tailBytes = 65536): number
   }
   try {
     const size = statSync(path).size
-    const start = Math.max(0, size - tailBytes)
-    const len = size - start
-    if (len <= 0) return null
-    const buf = Buffer.allocUnsafe(len)
-    let read = 0
-    while (read < len) {
-      const n = readSync(fd, buf, read, len - read, start + read)
-      if (n <= 0) break
-      read += n
-    }
-    const lines = buf.subarray(0, read).toString('utf8').split(/\r?\n/)
-    for (let i = lines.length - 1; i >= 0; i--) {
-      const line = lines[i].trim()
-      if (!line) continue
-      let obj: unknown
-      try {
-        obj = JSON.parse(line)
-      } catch {
-        continue // partial leading line / non-json → skip
+    if (size <= 0) return null
+    let window = Math.max(tailBytes, 1)
+    for (;;) {
+      const start = Math.max(0, size - window)
+      const len = size - start
+      const buf = Buffer.allocUnsafe(len)
+      let read = 0
+      while (read < len) {
+        const n = readSync(fd, buf, read, len - read, start + read)
+        if (n <= 0) break
+        read += n
       }
-      const ts = (obj as { timestamp?: unknown })?.timestamp
-      if (typeof ts === 'string') {
-        const ms = Date.parse(ts)
-        if (!Number.isNaN(ms)) return ms
-      } else if (typeof ts === 'number' && Number.isFinite(ts)) {
-        return ts
+      const atFileStart = start === 0
+      const lines = buf.subarray(0, read).toString('utf8').split(/\r?\n/)
+      // Segment 0 is a complete record ONLY when the window reaches byte 0; otherwise it is the possibly
+      // truncated tail of an earlier record and must not be parsed (`floor` skips it).
+      const floor = atFileStart ? 0 : 1
+      for (let i = lines.length - 1; i >= floor; i--) {
+        const line = lines[i].trim()
+        if (!line) continue
+        let obj: unknown
+        try {
+          obj = JSON.parse(line)
+        } catch {
+          continue // metadata fragment / non-json → skip
+        }
+        const ts = (obj as { timestamp?: unknown })?.timestamp
+        if (typeof ts === 'string') {
+          const ms = Date.parse(ts)
+          if (!Number.isNaN(ms)) return ms
+        } else if (typeof ts === 'number' && Number.isFinite(ts)) {
+          return ts
+        }
       }
+      // No complete timestamped entry in this window. If the whole file is read, there genuinely is none.
+      // Otherwise the tail record outgrows the window → grow and retry (terminates: window hits size → start 0).
+      if (atFileStart) return null
+      window *= 2
     }
-    return null
   } catch {
     return null
   } finally {

package/src/launch/types.ts

@@ -235,6 +235,32 @@ export interface RuntimeAdapter {
    */
   deliveryMarkers: DeliveryMarkers
 
+  /**
+   * How a delivered envelope's LANDING is confirmed AFTER the socket-ack, in
+   * deliverViaHost (transport). Owned by the adapter because it is a property of
+   * HOW the runtime logs an accepted message, not transport policy. A router
+   * (kind:'router') is always socket-ack by structure and short-circuits before
+   * this field is read; it refines the TUI runtimes. Absent → 'transcript' (the
+   * strict default: a new/unknown runtime gets the swallow-guarding confirm, never
+   * a weaker one).
+   *   - 'transcript' (claude): the runtime writes an acceptance record CARRYING the
+   *     envelope PROMPTLY — sub-second: a queue-operation when busy, the user-turn
+   *     when idle. So a message-specific transcript-carries-envelope check within a
+   *     short grace BOTH proves landing AND catches a paste swallowed at a turn
+   *     boundary (the false-OK class, incident 2026-06-23). Cheap and safe → keep it.
+   *   - 'socket-ack' (codex): the runtime writes NO acceptance record — its
+   *     session-jsonl user-input appears only when the model TURN INGESTS the
+   *     message, which during a long turn is many tens of seconds away (measured ~80s
+   *     live, 2026-06-25). But its input queue is DURABLE: a mid-turn submit is HELD
+   *     and processed at the next turn boundary, never lost (verified live — an 80s
+   *     turn still ingested + replied with the exact probe token). So the flushed
+   *     socket-ack (bytes left us AND drained to the pty) IS the delivery confirm; a
+   *     transcript grace here only ever FALSE-FAILs a message that WILL be processed,
+   *     wrongly escalating to a fallback peer. A genuinely dead session still fails
+   *     at the socket-ack (no socket / stalled flush) → really-dead still escalates.
+   */
+  deliveryConfirm?: 'transcript' | 'socket-ack'
+
   /**
    * If set, launch REFUSES unless the peer's intelligence equals this value
    * (fail-loud). telegram → 'natural' — it is a human channel; launching an

package/src/transport/index.ts

@@ -157,20 +157,19 @@ export function resolvePeerDeliveryTarget(
 const LIVENESS_POLL_MS = 100
 
 // Confirm grace — how long deliverViaHost polls for a transcript record CARRYING our envelope before
-// declaring a false-FAIL. Per-RUNTIME because the runtimes log an accepted injection at different
-// times: claude writes the queue-operation (busy) / user-turn (idle) record PROMPTLY (sub-second), so
-// a short grace suffices; codex writes its session-jsonl user-input only at model-turn-START (TTFT
-// measured ~4-6s after submit), so it needs a longer window or every codex delivery would false-FAIL
-// before the first write. `IAP_HOST_LIVENESS_GRACE_MS` overrides BOTH (operator calibration; tests set
-// 0 for an immediate deterministic fail). Prefer a false-FAIL (sender retries) over a false-OK (silent
-// loss, which the contract forbids).
-const CONFIRM_GRACE_CLAUDE_MS = 4000
-const CONFIRM_GRACE_CODEX_MS = 8000
-function confirmGraceMs(runtime: string): number {
+// declaring a false-FAIL. This applies ONLY to the 'transcript'-confirm runtimes (claude): claude
+// writes the queue-operation (busy) / user-turn (idle) record PROMPTLY (sub-second), so a short grace
+// suffices and the confirm doubles as a swallow-guard. codex is 'socket-ack' (adapter.deliveryConfirm)
+// and never reaches this loop — its input queue is durable but it logs the user-input only at ingest
+// (tens of seconds into a long turn), so a grace would only false-FAIL a message that WILL be processed.
+// `IAP_HOST_LIVENESS_GRACE_MS` overrides (operator calibration; tests set 0 for an immediate
+// deterministic fail). Prefer a false-FAIL (sender retries) over a false-OK (silent loss, forbidden).
+const CONFIRM_GRACE_MS = 4000
+function confirmGraceMs(): number {
   const raw = process.env.IAP_HOST_LIVENESS_GRACE_MS
   const n = raw === undefined ? NaN : Number(raw)
   if (Number.isFinite(n) && n >= 0) return n
-  return runtime === 'codex' ? CONFIRM_GRACE_CODEX_MS : CONFIRM_GRACE_CLAUDE_MS
+  return CONFIRM_GRACE_MS
 }
 
 // Launchd-revive retry — a MISS on a launchd-managed target the daemon can't wake (H4)
@@ -204,13 +203,17 @@ export interface WarmDeliverSeam {
 }
 
 /**
- * Warm-deliver `envelope` to a LIVE local target over its supervisor socket (pty-only). Landing is
- * CONFIRMED MESSAGE-SPECIFICALLY — by a NEW transcript record CARRYING this envelope appearing past the
- * pre-deliver baseline, NOT the socket-ack (a flushed CR proves the bytes left us, not that the session
- * accepted them) and NOT a bare mtime advance (the receiver's OWN concurrent turn bumps mtime even when
- * our paste was swallowed — the false-OK class the contract forbids). A router (telegram/notifier) has
- * no transcript → confirmed by the socket-ack (liveness is structural via launchd KeepAlive). See
- * `deliverViaHost`.
+ * Warm-deliver `envelope` to a LIVE local target over its supervisor socket (pty-only). Confirmation is
+ * adapter-driven (RuntimeAdapter.deliveryConfirm):
+ *   - 'transcript' (claude): CONFIRMED MESSAGE-SPECIFICALLY — by a NEW transcript record CARRYING this
+ *     envelope appearing past the pre-deliver baseline, NOT the socket-ack (a flushed CR proves the
+ *     bytes left us, not that the session accepted them) and NOT a bare mtime advance (the receiver's
+ *     OWN concurrent turn bumps mtime even when our paste was swallowed — the false-OK class, forbidden).
+ *   - 'socket-ack' (codex): confirmed by the socket-ack — its input queue is durable (a mid-turn submit
+ *     is never lost) and it logs no prompt-acceptance record, so a transcript grace would only false-FAIL.
+ *   - router (telegram/notifier): no transcript → confirmed by the socket-ack (liveness is structural
+ *     via launchd KeepAlive).
+ * See `deliverViaHost`.
  */
 export async function deliverWarm(
   target: DeliveryTarget,
@@ -244,21 +247,32 @@ async function deliverViaHost(
   // router's liveness is structural via launchd KeepAlive (not a model turn), so the ack IS the
   // delivery-level confirm (parity with the legacy tmux router C-j path).
   if (adapter.kind === 'router') return ok(undefined)
+  // 'socket-ack' TUI runtimes (codex): the input queue is DURABLE — a mid-turn submit is HELD and
+  // processed at the next turn boundary, however long that is (verified live 2026-06-25: an 80s turn
+  // still ingested + replied; the send false-FAILed at the 8s grace, the message was NOT lost). codex
+  // writes NO prompt-acceptance record (its user-input lands only at ingest), so a transcript grace
+  // can't tell "swallowed" from "queued-but-not-yet-ingested" within any useful window — it only
+  // false-FAILs a message that WILL be delivered, wrongly escalating to a fallback peer. The flushed
+  // socket-ack above IS the delivery confirm; a genuinely dead session already failed at deliverHosted
+  // (no socket / stalled flush) → really-dead still escalates. (claude stays on the strict
+  // message-specific confirm below — it logs acceptance sub-second, so that is cheap AND catches a
+  // swallowed paste, the false-OK class.) Driven by adapter.deliveryConfirm, not a hardcoded runtime.
+  if (adapter.deliveryConfirm === 'socket-ack') return ok(undefined)
   // socket-ack ≠ landed. With no transcript (direct callers/tests without a cwd) we can only trust the
   // flushed submit — confirmed-only.
   if (!cwd || !baseline) return ok(undefined)
-  // MESSAGE-SPECIFIC landed-confirm — the false-OK killer. A bare transcript/pane-log mtime BUMP is
-  // NOT proof the session took THIS message: a receiver in an active turn advances both mtimes with
-  // its OWN rendering even when our paste was swallowed at the turn boundary (incident 2026-06-23:
-  // ok=true, message gone). The ONLY proof is a NEW transcript record CARRYING our envelope —
-  //   claude: a queue-operation `content` (busy → enqueued) or the user-turn message (idle),
-  //   codex:  a user-input response_item (written at model-turn-start, ~4-6s — hence the codex grace).
-  // The receiver's own assistant/tool turn never reproduces the `<iap from-personality=…>` wrapper, so
-  // it cannot forge a confirm. No such record within the grace → false-FAIL (the sender retries) — NOT
-  // a false-OK (silent loss the contract forbids).
+  // MESSAGE-SPECIFIC landed-confirm — the false-OK killer (claude / any 'transcript'-confirm runtime;
+  // codex took the socket-ack short-circuit above). A bare transcript/pane-log mtime BUMP is NOT proof
+  // the session took THIS message: a receiver in an active turn advances both mtimes with its OWN
+  // rendering even when our paste was swallowed at the turn boundary (incident 2026-06-23: ok=true,
+  // message gone). The ONLY proof is a NEW transcript record CARRYING our envelope — for claude, a
+  // queue-operation `content` (busy → enqueued) or the user-turn message (idle), written sub-second so
+  // a short grace covers it. The receiver's own assistant/tool turn never reproduces the
+  // `<iap from-personality=…>` wrapper, so it cannot forge a confirm. No such record within the grace →
+  // false-FAIL (the sender retries) — NOT a false-OK (silent loss the contract forbids).
   const confirm = seam.confirmLanded ?? ((payload: string) => transcriptCarriesEnvelope(baseline, payload))
   const sleep = seam.sleep ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)))
-  const graceMs = confirmGraceMs(target.runtime)
+  const graceMs = confirmGraceMs()
   const graceDeadline = monotonicMs() + graceMs
   while (true) {
     if (confirm(envelope)) return ok(undefined)