@agfpd/iapeer 0.4.39 → 0.4.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.39",
+  "version": "0.4.41",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -64,7 +64,7 @@ import {
   validateProfileStandard,
 } from '../identity/profileStandard.ts'
 import { runAlwaysOn } from '../launch/launchdRun.ts'
-import { ensureDaemonStarted, installDaemonPlist, startConfiguredDaemon } from '../daemon/main.ts'
+import { ensureDaemonStarted, installDaemonPlist, parseDaemonPort, startConfiguredDaemon } from '../daemon/main.ts'
 import { MARKETPLACE_NAME, onboardHost, runtimeAuthNote, tccFullDiskAccessNote } from '../onboard/index.ts'
 import { probeFullDiskAccess, readMemoryProvider } from '../status/index.ts'
 import { appendLifecycleEvent } from '../lifecycle/eventlog.ts'
@@ -2242,7 +2242,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
           return 0
         }
         const handle = await startConfiguredDaemon({
-          port: env.IAPEER_PORT?.trim() ? Number(env.IAPEER_PORT) : undefined,
+          port: parseDaemonPort(env.IAPEER_PORT), // В29 — strict: NaN/out-of-range → default, never an ephemeral port
           socketPath: env.IAPEER_DAEMON_SOCKET?.trim() || undefined,
           env,
         })

package/src/daemon/index.ts

@@ -21,6 +21,7 @@
 // same-uid and should add a bearer token before production exposure — OPEN.
 
 import { createServer as createHttpServer, type IncomingMessage, type ServerResponse } from 'http'
+import { createConnection } from 'net'
 import { chmodSync, existsSync, mkdirSync, unlinkSync } from 'fs'
 import { dirname, join } from 'path'
 import { Server } from '@modelcontextprotocol/sdk/server/index.js'
@@ -49,6 +50,30 @@ import { appendDeliveryEvent } from './deliverylog.ts'
 export const CALLER_HEADER = 'x-iapeer-identity'
 const SERVER_INFO = { name: 'iapeer', version: '0.0.0' }
 
+/** Does a LIVE listener answer on this unix socket path? (В28) A successful connect ⇒ a daemon is
+ *  running; ECONNREFUSED ⇒ a stale socket file (safe to unlink). Bounded by a short timeout so a wedged
+ *  socket never hangs startup. */
+function socketIsLive(socketPath: string, timeoutMs = 500): Promise<boolean> {
+  return new Promise<boolean>(resolve => {
+    let settled = false
+    const finish = (live: boolean): void => {
+      if (settled) return
+      settled = true
+      try {
+        c.destroy()
+      } catch {
+        /* */
+      }
+      resolve(live)
+    }
+    const c = createConnection(socketPath)
+    c.once('connect', () => finish(true))
+    c.once('error', () => finish(false))
+    const t = setTimeout(() => finish(false), timeoutMs)
+    if (typeof t.unref === 'function') t.unref()
+  })
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Caller identity from the request header
 // ─────────────────────────────────────────────────────────────────────────────
@@ -487,7 +512,16 @@ export async function startDaemon(opts: StartDaemonOptions = {}): Promise<Daemon
   // Unix-socket listener (H8 same-uid base, 0600).
   if (socketPath) {
     mkdirSync(dirname(socketPath), { recursive: true, mode: 0o700 })
-    if (existsSync(socketPath)) unlinkSync(socketPath)
+    if (existsSync(socketPath)) {
+      // В28 — a LIVE daemon may already own this socket. Unlinking it out from under a live listener
+      // silently breaks every unix-socket caller (CLI/notifier/telegram) until a restart. Probe first:
+      // if a daemon answers, REFUSE to start (touch nothing). Only a STALE socket file (no listener,
+      // ECONNREFUSED) is removed. Guards the documented `iapeer daemon` foreground acceptance mode.
+      if (await socketIsLive(socketPath)) {
+        throw new Error(`a daemon is already listening on ${socketPath} — refusing to start a second instance`)
+      }
+      unlinkSync(socketPath)
+    }
     const s = createHttpServer(handle)
     await new Promise<void>((resolve, reject) => {
       s.once('error', reject)

package/src/daemon/main.ts

@@ -72,6 +72,19 @@ import { defaultDaemonSocketPath, startDaemon, type DaemonHandle } from './index
  *  a STABLE port, not an ephemeral one. Override with IAPEER_PORT. */
 export const DEFAULT_DAEMON_PORT = 8765
 
+/** Parse IAPEER_PORT STRICTLY (В29). `Number('abc')` = NaN passes `?? DEFAULT` (NaN is not nullish) →
+ *  listen(NaN) binds an EPHEMERAL port while the fleet's .mcp.json points at the fixed 8765 → the whole
+ *  TCP-MCP surface is silently offline yet the daemon reads "healthy" (health probes only the unix
+ *  socket). Unset/empty → the default; anything not an integer in 1–65535 → a LOUD warn + the default. */
+export function parseDaemonPort(raw: string | undefined, dflt: number = DEFAULT_DAEMON_PORT): number {
+  const t = raw?.trim()
+  if (!t) return dflt
+  const n = Number(t)
+  if (Number.isInteger(n) && n >= 1 && n <= 65535) return n
+  process.stderr.write(`[iapeer-daemon] WARN invalid IAPEER_PORT=${JSON.stringify(raw)} — falling back to ${dflt}\n`)
+  return dflt
+}
+
 /** Default supervise-tick cadence (idle-reap / zombie-sweep). idleSecs (1h default)
  *  is the reap threshold; this is just how often the timer checks. */
 export const DEFAULT_SUPERVISE_INTERVAL_MS = 60_000
@@ -213,7 +226,8 @@ function queuedFailureMessage(job: ComposerQueuedDelivery, reason: string): stri
 export function makeComposerQueueRouteDeps(cfg: LifecycleConfig, env: NodeJS.ProcessEnv): ComposerQueueRouteDeps {
   const noteLiveTopic = makeNoteLiveTopic(cfg, env)
   const onDelivered = makeArmEphemeralOnDelivered(cfg)
-  const wake = makeWakeFn(cfg, env)
+  // NB: no `wake` here — the composer-queue failure outlet (notifyFailed) deliberately does NOT wake an
+  // offline sender (В30); it fires on failAll during shutdown/update.
   const ephemeral = makeEphemeralRouteDeps(cfg, env)
 
   return createComposerDeliveryQueue({
@@ -269,7 +283,12 @@ export function makeComposerQueueRouteDeps(cfg: LifecycleConfig, env: NodeJS.Pro
         // Do not pass composerQueue here: this path is the queue's failure outlet
         // (including SIGTERM/update). Recursively queueing a failure notification
         // could turn shutdown re-fail into another queued item.
-        { wake, ephemeral, noteLiveTopic },
+        // В30 — NO wake dep either: this outlet fires on failAll (SIGTERM/update). Waking an offline
+        // sender to notify it takes 30-60s (ready-gate), blowing past launchd's ExitTimeOut → SIGKILL
+        // drops the remaining notifications (the very silent loss failAll exists to prevent) and stalls
+        // the restart. An ephemeral sender still gets a DURABLE-queued notification (ephemeral dep); a
+        // non-ephemeral offline sender degrades to a delivery.log record (best-effort) — never a wake.
+        { ephemeral, noteLiveTopic },
       )
       appendDeliveryEvent(cfg.eventLogDir, {
         ev: 'composer-queue-failed-notify',
@@ -542,7 +561,7 @@ if (import.meta.main) {
   } else {
     const env = process.env
     const handle = await startConfiguredDaemon({
-      port: Number(env.IAPEER_PORT ?? DEFAULT_DAEMON_PORT),
+      port: parseDaemonPort(env.IAPEER_PORT),
       socketPath: env.IAPEER_DAEMON_SOCKET?.trim() || undefined,
       env,
     })

package/src/supervisor/client.ts

@@ -2,9 +2,9 @@
 // Block 2, ported from PoC pts.mjs). Detach key Ctrl-] (session keeps running). The two reattach
 // port-deps live here + in protocol.ts: #1 TERM_RESET on EVERY exit path (incl. SIGHUP window-close,
 // via writeSync which works inside a signal handler), and #2 backpressure is the daemon's side.
-import { existsSync, readFileSync, writeSync } from 'node:fs'
+import { writeSync } from 'node:fs'
 import { FRAME_DATA, FRAME_RESIZE, TERM_RESET, frame, makeFramer, sizePayload } from './protocol.ts'
-import { pidPath, sockPath } from './paths.ts'
+import { pidStartToken, readPidFile, sockPath } from './paths.ts'
 
 const DETACH = 0x1d // Ctrl-]
 
@@ -16,9 +16,26 @@ const pidAlive = (p: number): boolean => {
     return false
   }
 }
+
+// В22 — OWNER-validated liveness. kill(pid,0) is the fast fail (dead pid → not alive). When the pid is
+// alive AND the pidfile carries a start-token, verify the token matches the pid's CURRENT start time so a
+// REUSED pid (a different process that inherited the number) never reads as our live session. `ps` is
+// bounded by a short per-session cache — repeated liveness reads within a tick do not re-spawn it.
+const OWNER_TTL_MS = 3000
+const ownerCache = new Map<string, { pid: number; token: string; verdict: boolean; until: number }>()
+
 export function sessionAlive(runDir: string, session: string): boolean {
-  const pf = pidPath(runDir, session)
-  return existsSync(pf) && pidAlive(Number(readFileSync(pf, 'utf8')))
+  const rec = readPidFile(runDir, session)
+  if (!rec || !pidAlive(rec.pid)) return false
+  if (!rec.token) return true // legacy tokenless pidfile → kill-0 only (no regression during rollout)
+  const key = `${runDir}\0${session}`
+  const now = Date.now()
+  const cached = ownerCache.get(key)
+  if (cached && cached.pid === rec.pid && cached.token === rec.token && now < cached.until) return cached.verdict
+  const live = pidStartToken(rec.pid)
+  const verdict = live !== null && live === rec.token // same process instance, not a reused pid
+  ownerCache.set(key, { pid: rec.pid, token: rec.token, verdict, until: now + OWNER_TTL_MS })
+  return verdict
 }
 
 /** Attach an interactive terminal client to a live daemon session. Resolves when the client

package/src/supervisor/daemon.ts

@@ -25,7 +25,7 @@ import {
   splitDanglingEscape,
   stripQueries,
 } from './protocol.ts'
-import { attachedPath, geometryPath, pidPath, servePath, sockPath, writeGeometry } from './paths.ts'
+import { attachedPath, geometryPath, pidPath, servePath, sockPath, writeGeometry, writePidFile } from './paths.ts'
 import { nextBootAction, nextNagAction, type BootPredicates, type NagPredicate } from './boot.ts'
 import { modelToPlainText } from './render.ts'
 import { codexAdapter } from '../launch/adapters/codex.ts'
@@ -515,7 +515,7 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
       },
     },
   })
-  writeFileSync(pid, String(process.pid))
+  writePidFile(runDir, session, process.pid) // В22 — `<pid> <startToken>` so a reused pid can't impersonate this session
   writeGeometry(runDir, session, serveCols, serveRows) // initial geometry sidecar (= serve); updated on every real child resize
 
   let down = false

package/src/supervisor/index.ts

@@ -8,7 +8,7 @@ import { spawn as nodeSpawn } from 'node:child_process'
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { runSupervisorClient, sessionAlive } from './client.ts'
-import { defaultRunDir, logPath, pidPath, servePath, sockPath } from './paths.ts'
+import { defaultRunDir, logPath, pidPath, pidStartToken, readPidFile, servePath, sockPath } from './paths.ts'
 
 // daemon.ts loads @xterm. It is dynamic-imported ONLY in the 'daemon' CLI case below (the detached
 // daemon process, where @xterm belongs), so importing THIS module — e.g. launch resolving
@@ -125,17 +125,35 @@ export async function startSupervisorDaemon(opts: StartDaemonOptions): Promise<S
   const deadline = Date.now() + (opts.timeoutMs ?? 5000)
   while (Date.now() < deadline) {
     if (existsSync(sockPath(runDir, session)) && sessionAlive(runDir, session)) {
-      return { state: 'started', pid: Number(readFileSync(pidPath(runDir, session), 'utf8')) }
+      return { state: 'started', pid: readPidFile(runDir, session)?.pid }
     }
     await Bun.sleep(80) // yield the loop — never a sync block in the daemon's wake path
   }
-  // Failed to come up — drop the serve-spec we wrote so it can't mislead a later read.
+  // Failed to come up in time. В20 — KILL the spawned child FIRST. A merely-slow child that becomes the
+  // daemon AFTER we unlink the serve-spec would readServeSpec → undefined → come up as a BARE CONDUIT
+  // ([bin] runtime with NO PEER_IDENTITY / composed argv / doctrine) that captures the peer's identity:
+  // liveness then reads it "online", messages route into an identity-less session, and if it slipped
+  // past enroll-on-FAILED it is invisible to idle-reap (an unbounded orphan). Better a dead peer (the
+  // next wake respawns clean) than an identity-less conduit. Kill, THEN drop the spec + any stale
+  // sock/pid the dying child created (SIGKILL skips the child's own cleanup).
+  try {
+    child.kill('SIGKILL')
+  } catch {
+    /* already gone */
+  }
   if (opts.serve)
     try {
       unlinkSync(servePath(runDir, session))
     } catch {
       /* */
     }
+  for (const p of [sockPath(runDir, session), pidPath(runDir, session)]) {
+    try {
+      if (existsSync(p)) unlinkSync(p)
+    } catch {
+      /* best-effort */
+    }
+  }
   return { state: 'failed', detail: `daemon did not come up; see ${logPath(runDir, session)}` }
 }
 
@@ -146,16 +164,22 @@ export function listSessions(runDir: string): Array<{ session: string; alive: bo
     .map(f => f.replace(/\.sock$/, ''))
     .map(session => {
       const alive = sessionAlive(runDir, session)
-      return { session, alive, pid: alive ? Number(readFileSync(pidPath(runDir, session), 'utf8')) : undefined }
+      return { session, alive, pid: alive ? readPidFile(runDir, session)?.pid : undefined }
     })
 }
 
 export function killSession(runDir: string, session: string): boolean {
-  const pf = pidPath(runDir, session)
-  if (!existsSync(pf)) return false
-  const pid = Number(readFileSync(pf, 'utf8'))
+  const rec = readPidFile(runDir, session)
+  if (!rec) return false
+  // В22 — verify the pid is STILL our daemon before SIGTERM. After an abnormal death + pid reuse, a bare
+  // kill here would SIGTERM the INNOCENT process that inherited the pid. Skip the kill when the start-token
+  // no longer matches (a legacy tokenless pidfile keeps the old behavior — no regression during rollout).
+  if (rec.token) {
+    const live = pidStartToken(rec.pid)
+    if (live !== null && live !== rec.token) return false // reused pid — NOT our session; do not signal it
+  }
   try {
-    process.kill(pid, 'SIGTERM')
+    process.kill(rec.pid, 'SIGTERM')
   } catch {
     /* already gone */
   }

package/src/supervisor/paths.ts

@@ -3,6 +3,7 @@
 // socket/pid files never touch a real location.
 import { renameSync, writeFileSync } from 'node:fs'
 import { readFileSync } from 'node:fs'
+import { spawnSync } from 'node:child_process'
 import { join } from 'node:path'
 import { pluginStateDir } from '../storage/index.ts'
 
@@ -13,6 +14,49 @@ export function defaultRunDir(env: NodeJS.ProcessEnv = process.env): string {
 
 export const sockPath = (runDir: string, session: string): string => join(runDir, `${session}.sock`)
 export const pidPath = (runDir: string, session: string): string => join(runDir, `${session}.pid`)
+
+// ── pid-OWNERSHIP token (В22) ───────────────────────────────────────────────────
+// kill(pid,0) proves SOME process holds the pid, not that it is STILL our daemon: after an abnormal
+// death (SIGKILL/panic/reboot) the pidfile survives, and if the OS reuses that pid for another same-uid
+// process, a bare kill(pid,0) reads the dead session as "alive" (peer undeliverable + unreapable) and a
+// kill() would SIGTERM the innocent reuser. The pidfile therefore stores `<pid> <startToken>` where the
+// token is the process's start time; a reused pid has a DIFFERENT start time, so ownership is verifiable.
+
+/** The OS-reported start time of `pid` (a stable per-process-instance token), or null if it is not
+ *  running / unreadable. `ps -o lstart=` is a single spawn — callers bound its frequency (see the
+ *  liveness cache in client.ts). */
+export function pidStartToken(pid: number): string | null {
+  if (!Number.isInteger(pid) || pid <= 0) return null
+  try {
+    const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8' })
+    const t = (r.stdout ?? '').trim()
+    return t.length > 0 ? t : null
+  } catch {
+    return null
+  }
+}
+
+/** Write the pidfile as `<pid> <startToken>` (В22). Falls back to bare `<pid>` if the token is
+ *  unavailable — a tokenless pidfile is treated as legacy (owner-check skipped, kill-0 only). */
+export function writePidFile(runDir: string, session: string, pid: number): void {
+  const token = pidStartToken(pid)
+  writeFileSync(pidPath(runDir, session), token ? `${pid} ${token}` : String(pid))
+}
+
+/** Parse the pidfile → { pid, token } (token '' for a legacy bare-pid file). null when absent/invalid. */
+export function readPidFile(runDir: string, session: string): { pid: number; token: string } | null {
+  let raw: string
+  try {
+    raw = readFileSync(pidPath(runDir, session), 'utf8').trim()
+  } catch {
+    return null
+  }
+  if (!raw) return null
+  const sp = raw.indexOf(' ')
+  const pid = Number(sp < 0 ? raw : raw.slice(0, sp))
+  if (!Number.isInteger(pid) || pid <= 0) return null
+  return { pid, token: sp < 0 ? '' : raw.slice(sp + 1).trim() }
+}
 export const logPath = (runDir: string, session: string): string => join(runDir, `${session}.log`)
 /** Serving spec (cutover Block 2 slice b): the composed {argv, env, cwd} a detached daemon serves.
  *  Written 0600 by startSupervisorDaemon BEFORE spawn (env can carry launch.env secrets), read by