@agfpd/iapeer 0.4.36 → 0.4.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.36",
+  "version": "0.4.38",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/daemon/index.ts

@@ -192,6 +192,8 @@ export interface CallToolDeps {
    *  see transport.RouteDeps.noteLiveTopic. Injected so the daemon never imports
    *  lifecycle; the production main wires makeNoteLiveTopic. */
   noteLiveTopic?: (identity: string, topic: string) => void
+  /** В7 — confirmed-delivery stamp → the target's idle-proxy floor (see transport.RouteDeps.noteDelivered). */
+  noteDelivered?: (identity: string) => void
   /** Busy-human-composer queue — see transport.createComposerDeliveryQueue. */
   composerQueue?: ComposerQueueRouteDeps
   /** H4 launchd-managed detector — see transport.RouteDeps.isLaunchdManaged (the
@@ -219,6 +221,7 @@ export async function callTool(
       wake: deps.wake,
       ephemeral: deps.ephemeral,
       noteLiveTopic: deps.noteLiveTopic,
+      noteDelivered: deps.noteDelivered,
       composerQueue: deps.composerQueue,
       isLaunchdManaged: deps.isLaunchdManaged,
     })
@@ -390,6 +393,9 @@ export interface StartDaemonOptions extends StorageOptions {
    * main wires the lifecycle marker write (makeNoteLiveTopic).
    */
   noteLiveTopic?: (identity: string, topic: string) => void
+  /** В7 — confirmed-delivery stamp → the target's idle-proxy floor (setLastDelivered). OFF by default;
+   *  the production main wires it. */
+  noteDelivered?: (identity: string) => void
   /**
    * Busy-human-composer queue — async acceptance for live local TUI delivery when
    * an attached operator has non-dim text in the target composer. OFF by default
@@ -433,6 +439,7 @@ export async function startDaemon(opts: StartDaemonOptions = {}): Promise<Daemon
       onDelivered: opts.onDelivered,
       ephemeral: opts.ephemeral,
       noteLiveTopic: opts.noteLiveTopic,
+      noteDelivered: opts.noteDelivered,
       composerQueue: opts.composerQueue,
       isLaunchdManaged: opts.isLaunchdManaged,
     })

package/src/daemon/main.ts

@@ -42,6 +42,7 @@ import {
   readTopic,
   resolveWakeRuntime,
   setEphemeralArmed,
+  setLastDelivered,
   superviseTick,
   wakeOrSpawn,
   type LifecycleConfig,
@@ -222,6 +223,7 @@ export function makeComposerQueueRouteDeps(cfg: LifecycleConfig, env: NodeJS.Pro
     // flip + the shadow observer. tmux targets ignore it.
     logDir: cfg.logDir,
     noteLiveTopic,
+    noteDelivered: identity => setLastDelivered(cfg, identity),
     onDelivered,
     notifyFailed: async (job, reason) => {
       const index = readPeersIndex({ env })
@@ -330,6 +332,9 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
     // the wake resolver's executor discriminator then compares against the topic
     // the session last WORKED ON, not the one it woke with.
     noteLiveTopic,
+    // В7 — a confirmed live delivery floors the target's idle proxy (setLastDelivered), so a
+    // just-delivered message is never reaped away before its turn record lands.
+    noteDelivered: identity => setLastDelivered(cfg, identity),
     // Busy-human-composer queue: fast queued ack, async drain, fail all pending
     // on daemon close/update so a queued envelope is never silently lost.
     composerQueue,
@@ -547,6 +552,25 @@ if (import.meta.main) {
     }
     process.on('SIGTERM', shutdown)
     process.on('SIGINT', shutdown)
+    // В5 — a NON-signal crash (an unhandledRejection, or any uncaught error) would otherwise kill the
+    // daemon WITHOUT running handle.close() → failAll, so in-memory composer-queued messages (the sender
+    // already got queued:true) would vanish SILENTLY — the forbidden loss class. Run failAll on these
+    // paths too so senders are notified, then exit(1) so launchd KeepAlive respawns a clean daemon. A
+    // bounded timeout guarantees the exit even if close() hangs. (Hard SIGKILL/OOM cannot be caught — a
+    // durable on-disk composer queue would be needed for that, a deliberate follow-up.)
+    let crashing = false
+    const crashExit = (kind: string) => (errObj: unknown) => {
+      if (crashing) return
+      crashing = true
+      const detail = errObj instanceof Error ? (errObj.stack ?? errObj.message) : String(errObj)
+      process.stderr.write(`[iapeer-daemon] ${kind} — failing pending queued deliveries then exiting: ${detail}\n`)
+      const done = (): never => process.exit(1)
+      const t = setTimeout(done, 3000)
+      if (typeof t.unref === 'function') t.unref()
+      void handle.close().then(done, done)
+    }
+    process.on('uncaughtException', crashExit('uncaughtException'))
+    process.on('unhandledRejection', crashExit('unhandledRejection'))
     await new Promise(() => {}) // launchd KeepAlive holds this process; block forever
   }
 }

package/src/lifecycle/index.ts

@@ -292,6 +292,34 @@ export function clearIdleReaped(cfg: LifecycleConfig, identity: string): void {
   }
 }
 
+function lastDeliveredPath(cfg: LifecycleConfig, identity: string): string {
+  return join(cfg.stateDir, `${identity}.last-delivered`)
+}
+
+/** Stamp the moment a live delivery to this session was CONFIRMED (В7). superviseTick folds this into
+ *  the idle proxy so a message delivered just as the session crosses idleSecs cannot be reaped out from
+ *  under the just-delivered message before the runtime writes its turn record — the receiver's own
+ *  process may not have appended the user-turn yet (codex socket-ack lands ok BEFORE ingest), so the
+ *  transcript proxy alone would miss it and the reap would silently drop the message behind ok:true. */
+export function setLastDelivered(cfg: LifecycleConfig, identity: string, nowMs: number = Date.now()): void {
+  mkdirSync(cfg.stateDir, { recursive: true, mode: 0o700 })
+  try {
+    writeFileSync(lastDeliveredPath(cfg, identity), String(nowMs), { mode: 0o600 })
+  } catch {
+    /* best-effort — the transcript proxy still governs; this only ADDS a floor, never removes one */
+  }
+}
+
+/** Epoch-ms of the last confirmed live delivery to this session, or 0 when none/unreadable. */
+export function readLastDelivered(cfg: LifecycleConfig, identity: string): number {
+  try {
+    const n = parseInt(readFileSync(lastDeliveredPath(cfg, identity), 'utf8').trim(), 10)
+    return Number.isFinite(n) && n > 0 ? n : 0
+  } catch {
+    return 0
+  }
+}
+
 function newEagerPath(cfg: LifecycleConfig, identity: string): string {
   return join(cfg.stateDir, `${identity}.new-eager`)
 }
@@ -727,6 +755,12 @@ export async function withWakeLock<T>(
     stale: 60_000,
     update: 5_000,
     retries: { retries: cfg.wakeLockRetries, factor: 1.3, minTimeout: 100, maxTimeout: 1_000 },
+    // В5 — a compromised wake-lock (mtime-refresh timer fired late, e.g. after system sleep >60s) MUST
+    // NOT rethrow from proper-lockfile's timer: unhandled it crashes the whole router and silently drops
+    // the in-memory composer queue. Log and continue — a controlled degrade beats killing the daemon.
+    onCompromised: (err: Error) => {
+      process.stderr.write(`[iapeer] WARN wake-lock compromised for ${identity} (continuing, not crashing): ${err.message}\n`)
+    },
   })
   try {
     return await fn()
@@ -1322,7 +1356,11 @@ function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome
   const ephemeral = isEphemeralPeer(s.cwd)
   let lt = 0
   try { lt = lastTurnMt(s.runtime, s.cwd) ?? 0 } catch { /* unreadable → wokeAt floor */ }
-  const mt = Math.max(lt, s.wokeAt)
+  // В7 — fold in the last CONFIRMED live delivery. A message delivered just as the session crosses
+  // idleSecs (codex acks BEFORE it writes the turn record) would otherwise be reaped out from under the
+  // just-delivered message before lt catches up — a silent loss behind ok:true. lastDelivered only ever
+  // RAISES the floor (a delivery is activity), so it can never keep a genuinely idle session alive.
+  const mt = Math.max(lt, s.wokeAt, readLastDelivered(cfg, s.identity))
   const ageSecs = Math.floor((nowMs - mt) / 1000)
   // wake_policy:ephemeral M2 — die-after-reply: an ARMED ephemeral session (the
   // daemon routed its outbound reply) is reaped after a QUIET window, checked

package/src/registry/index.ts

@@ -297,6 +297,13 @@ export async function withPeersLock<T>(
     stale: 10_000,
     update: 1_000,
     retries: { retries: 13, factor: 1.4, minTimeout: 50, maxTimeout: 500 },
+    // В5 — a compromised lock (e.g. the mtime-refresh timer fired late after system sleep, so the lock
+    // read as stale) MUST NOT rethrow from proper-lockfile's timer: unhandled, it would crash the whole
+    // router process and silently drop the in-memory composer queue. Log loudly and let the current
+    // (near-done) critical section finish — a controlled degrade beats taking the daemon down.
+    onCompromised: (err: Error) => {
+      process.stderr.write(`[iapeer] WARN peers-lock compromised (continuing, not crashing): ${err.message}\n`)
+    },
   })
   try {
     return await fn(paths)

package/src/transport/index.ts

@@ -217,13 +217,37 @@ export interface WarmDeliverSeam {
  *     via launchd KeepAlive).
  * See `deliverViaHost`.
  */
+// В6 — per-target delivery serialization. deliverToHost is paste → 300ms settle → CR over the pty; two
+// CONCURRENT deliveries to the SAME hosted session interleave their frames (paste2 lands inside paste1's
+// settle window → CR1 submits the SPLICED "envelope1envelope2" as one turn, CR2 submits an empty
+// composer; for a router target the splice breaks the mate's per-envelope framing). Chain deliveries per
+// address so each paste+settle+CR (and its confirm) completes as a UNIT before the next to that address
+// starts. Different addresses stay parallel. Covers the DOMINANT path — every agent send_to_peer routes
+// through the SINGLE daemon process; a rare CLI in-process `iapeer send` is a separate process this chain
+// does not span (fully hermetic serialization would live in the supervisor as a per-session transaction).
+const deliverTails = new Map<string, Promise<unknown>>()
+
 export async function deliverWarm(
   target: DeliveryTarget,
   envelope: string,
   cwd?: string,
   seam: WarmDeliverSeam = {},
 ): Promise<Result<void>> {
-  return deliverViaHost(target, envelope, cwd, seam)
+  const address = target.address
+  const prev = deliverTails.get(address) ?? Promise.resolve()
+  // run AFTER prev settles (success or failure) — a prior delivery's error must not stall the chain
+  const run = prev.then(
+    () => deliverViaHost(target, envelope, cwd, seam),
+    () => deliverViaHost(target, envelope, cwd, seam),
+  )
+  deliverTails.set(
+    address,
+    run.then(
+      () => {},
+      () => {},
+    ),
+  )
+  return run
 }
 
 async function deliverViaHost(
@@ -890,6 +914,10 @@ export interface RouteDeps {
    *  imports lifecycle (layering — main.ts is where the two meet); call sites
    *  swallow hook errors (a hook must never fail a delivered message). */
   noteLiveTopic?: (identity: string, topic: string) => void
+  /** В7 — stamp a CONFIRMED live delivery (target identity) so superviseTick's idle proxy floors on it
+   *  and cannot reap the session before the just-delivered message's turn record lands. Injected (same
+   *  layering as noteLiveTopic — lifecycle.setLastDelivered wired in main.ts). */
+  noteDelivered?: (identity: string) => void
   /** H4 launchd-managed detector (injected so transport never imports lifecycle —
    *  main.ts wires the real `isLaunchdManaged`). A MISS on a launchd-managed target is
    *  almost always a TRANSIENT restart window (router restart on connect / `iapeer
@@ -913,6 +941,16 @@ function noteTopic(deps: RouteDeps, identity: string, topic: string | undefined)
   }
 }
 
+/** Best-effort lastDelivered stamp (В7) — records a CONFIRMED live delivery so the idle-reap proxy
+ *  cannot reap the session out from under a just-delivered message before its turn record lands. */
+function noteDelivered(deps: RouteDeps, identity: string): void {
+  try {
+    deps.noteDelivered?.(identity)
+  } catch {
+    /* a post-delivery hook must never fail the delivery */
+  }
+}
+
 export interface ComposerDeliveryQueueOptions {
   env?: NodeJS.ProcessEnv
   pollMs?: number
@@ -938,6 +976,8 @@ export interface ComposerDeliveryQueueOptions {
   deliver?: (target: DeliveryTarget, envelope: string, cwd?: string) => Result<void> | Promise<Result<void>>
   notifyFailed: (job: ComposerQueuedDelivery, reason: string) => void | Promise<void>
   noteLiveTopic?: (identity: string, topic: string) => void
+  /** В7 — stamp a confirmed queued delivery (same seam as RouteDeps.noteDelivered). */
+  noteDelivered?: (identity: string) => void
   onDelivered?: (caller: ResolvedCaller) => void
 }
 
@@ -1025,7 +1065,17 @@ export function createComposerDeliveryQueue(opts: ComposerDeliveryQueueOptions):
   function kick(identity: string): void {
     if (draining.has(identity)) return
     draining.add(identity)
-    void drain(identity).finally(() => draining.delete(identity))
+    void drain(identity)
+      .catch(() => {
+        /* drain is internally best-effort; a stray throw must not surface as an unhandled rejection */
+      })
+      .finally(() => {
+        draining.delete(identity)
+        // В9 — close the enqueue-during-teardown race: a job pushed AFTER drain's empty-return but
+        // BEFORE this finally cleared `draining` saw kick() no-op (draining still held), leaving it
+        // undrained until some unrelated later enqueue. Re-kick if work remains so it drains promptly.
+        if (queues.get(identity)?.length) kick(identity)
+      })
   }
 
   async function drain(identity: string): Promise<void> {
@@ -1050,12 +1100,29 @@ export function createComposerDeliveryQueue(opts: ComposerDeliveryQueueOptions):
         continue
       }
 
-      const delivered = await deliver(job.target, job.envelope, job.peer.cwd)
+      // В8 — take the head OUT of the queue BEFORE committing to deliver. A concurrent failAll snapshots
+      // only what remains queued, so an IN-FLIGHT job is never both delivered AND failed (the dup / false-
+      // failure the exactly-once contract forbids). The head stayed queued during the composer poll-wait
+      // above (still undelivered → failAll correctly fails it); it leaves the queue only at this commit.
       q.shift()
+      let delivered: Result<void>
+      try {
+        delivered = await deliver(job.target, job.envelope, job.peer.cwd)
+      } catch (e) {
+        // deliverWarm normally returns a Result, but a defensive catch keeps drain from throwing (which,
+        // with the В9 re-kick, could otherwise spin) — an unexpected throw is a delivery failure.
+        await notifyFailed(job, `queued delivery to ${job.target.personality} (${job.target.runtime}) failed: ${e instanceof Error ? e.message : String(e)}`)
+        continue
+      }
       if (!delivered.ok) {
         await notifyFailed(job, `queued delivery to ${job.target.personality} (${job.target.runtime}) failed: ${delivered.error.message}`)
       } else {
         noteTopic({ noteLiveTopic: opts.noteLiveTopic }, job.target.address, job.topic)
+        try {
+          opts.noteDelivered?.(job.target.address) // В7 — floor the idle proxy for the queued delivery too
+        } catch {
+          /* best-effort */
+        }
         try {
           opts.onDelivered?.(job.caller)
         } catch {
@@ -1257,6 +1324,7 @@ export async function routeSend(
     const delivered = await deliverWarm(target.value, envelope, peer.cwd)
     if (!delivered.ok) return delivered
     noteTopic(deps, target.value.address, topic)
+    noteDelivered(deps, target.value.address) // В7 — floor the idle proxy so this delivery isn't reaped away
     return ok({
       ok: true,
       delivered_to: { personality: target.value.personality, runtime: target.value.runtime },