@agfpd/iapeer 0.4.40 → 0.4.42

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.40",
+  "version": "0.4.42",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -64,7 +64,7 @@ import {
   validateProfileStandard,
 } from '../identity/profileStandard.ts'
 import { runAlwaysOn } from '../launch/launchdRun.ts'
-import { ensureDaemonStarted, installDaemonPlist, startConfiguredDaemon } from '../daemon/main.ts'
+import { ensureDaemonStarted, installDaemonPlist, parseDaemonPort, startConfiguredDaemon } from '../daemon/main.ts'
 import { MARKETPLACE_NAME, onboardHost, runtimeAuthNote, tccFullDiskAccessNote } from '../onboard/index.ts'
 import { probeFullDiskAccess, readMemoryProvider } from '../status/index.ts'
 import { appendLifecycleEvent } from '../lifecycle/eventlog.ts'
@@ -2242,7 +2242,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
           return 0
         }
         const handle = await startConfiguredDaemon({
-          port: env.IAPEER_PORT?.trim() ? Number(env.IAPEER_PORT) : undefined,
+          port: parseDaemonPort(env.IAPEER_PORT), // В29 — strict: NaN/out-of-range → default, never an ephemeral port
           socketPath: env.IAPEER_DAEMON_SOCKET?.trim() || undefined,
           env,
         })

package/src/daemon/index.ts

@@ -21,6 +21,7 @@
 // same-uid and should add a bearer token before production exposure — OPEN.
 
 import { createServer as createHttpServer, type IncomingMessage, type ServerResponse } from 'http'
+import { createConnection } from 'net'
 import { chmodSync, existsSync, mkdirSync, unlinkSync } from 'fs'
 import { dirname, join } from 'path'
 import { Server } from '@modelcontextprotocol/sdk/server/index.js'
@@ -49,6 +50,30 @@ import { appendDeliveryEvent } from './deliverylog.ts'
 export const CALLER_HEADER = 'x-iapeer-identity'
 const SERVER_INFO = { name: 'iapeer', version: '0.0.0' }
 
+/** Does a LIVE listener answer on this unix socket path? (В28) A successful connect ⇒ a daemon is
+ *  running; ECONNREFUSED ⇒ a stale socket file (safe to unlink). Bounded by a short timeout so a wedged
+ *  socket never hangs startup. */
+function socketIsLive(socketPath: string, timeoutMs = 500): Promise<boolean> {
+  return new Promise<boolean>(resolve => {
+    let settled = false
+    const finish = (live: boolean): void => {
+      if (settled) return
+      settled = true
+      try {
+        c.destroy()
+      } catch {
+        /* */
+      }
+      resolve(live)
+    }
+    const c = createConnection(socketPath)
+    c.once('connect', () => finish(true))
+    c.once('error', () => finish(false))
+    const t = setTimeout(() => finish(false), timeoutMs)
+    if (typeof t.unref === 'function') t.unref()
+  })
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Caller identity from the request header
 // ─────────────────────────────────────────────────────────────────────────────
@@ -487,7 +512,16 @@ export async function startDaemon(opts: StartDaemonOptions = {}): Promise<Daemon
   // Unix-socket listener (H8 same-uid base, 0600).
   if (socketPath) {
     mkdirSync(dirname(socketPath), { recursive: true, mode: 0o700 })
-    if (existsSync(socketPath)) unlinkSync(socketPath)
+    if (existsSync(socketPath)) {
+      // В28 — a LIVE daemon may already own this socket. Unlinking it out from under a live listener
+      // silently breaks every unix-socket caller (CLI/notifier/telegram) until a restart. Probe first:
+      // if a daemon answers, REFUSE to start (touch nothing). Only a STALE socket file (no listener,
+      // ECONNREFUSED) is removed. Guards the documented `iapeer daemon` foreground acceptance mode.
+      if (await socketIsLive(socketPath)) {
+        throw new Error(`a daemon is already listening on ${socketPath} — refusing to start a second instance`)
+      }
+      unlinkSync(socketPath)
+    }
     const s = createHttpServer(handle)
     await new Promise<void>((resolve, reject) => {
       s.once('error', reject)

package/src/daemon/main.ts

@@ -72,6 +72,19 @@ import { defaultDaemonSocketPath, startDaemon, type DaemonHandle } from './index
  *  a STABLE port, not an ephemeral one. Override with IAPEER_PORT. */
 export const DEFAULT_DAEMON_PORT = 8765
 
+/** Parse IAPEER_PORT STRICTLY (В29). `Number('abc')` = NaN passes `?? DEFAULT` (NaN is not nullish) →
+ *  listen(NaN) binds an EPHEMERAL port while the fleet's .mcp.json points at the fixed 8765 → the whole
+ *  TCP-MCP surface is silently offline yet the daemon reads "healthy" (health probes only the unix
+ *  socket). Unset/empty → the default; anything not an integer in 1–65535 → a LOUD warn + the default. */
+export function parseDaemonPort(raw: string | undefined, dflt: number = DEFAULT_DAEMON_PORT): number {
+  const t = raw?.trim()
+  if (!t) return dflt
+  const n = Number(t)
+  if (Number.isInteger(n) && n >= 1 && n <= 65535) return n
+  process.stderr.write(`[iapeer-daemon] WARN invalid IAPEER_PORT=${JSON.stringify(raw)} — falling back to ${dflt}\n`)
+  return dflt
+}
+
 /** Default supervise-tick cadence (idle-reap / zombie-sweep). idleSecs (1h default)
  *  is the reap threshold; this is just how often the timer checks. */
 export const DEFAULT_SUPERVISE_INTERVAL_MS = 60_000
@@ -213,7 +226,8 @@ function queuedFailureMessage(job: ComposerQueuedDelivery, reason: string): stri
 export function makeComposerQueueRouteDeps(cfg: LifecycleConfig, env: NodeJS.ProcessEnv): ComposerQueueRouteDeps {
   const noteLiveTopic = makeNoteLiveTopic(cfg, env)
   const onDelivered = makeArmEphemeralOnDelivered(cfg)
-  const wake = makeWakeFn(cfg, env)
+  // NB: no `wake` here — the composer-queue failure outlet (notifyFailed) deliberately does NOT wake an
+  // offline sender (В30); it fires on failAll during shutdown/update.
   const ephemeral = makeEphemeralRouteDeps(cfg, env)
 
   return createComposerDeliveryQueue({
@@ -269,7 +283,12 @@ export function makeComposerQueueRouteDeps(cfg: LifecycleConfig, env: NodeJS.Pro
         // Do not pass composerQueue here: this path is the queue's failure outlet
         // (including SIGTERM/update). Recursively queueing a failure notification
         // could turn shutdown re-fail into another queued item.
-        { wake, ephemeral, noteLiveTopic },
+        // В30 — NO wake dep either: this outlet fires on failAll (SIGTERM/update). Waking an offline
+        // sender to notify it takes 30-60s (ready-gate), blowing past launchd's ExitTimeOut → SIGKILL
+        // drops the remaining notifications (the very silent loss failAll exists to prevent) and stalls
+        // the restart. An ephemeral sender still gets a DURABLE-queued notification (ephemeral dep); a
+        // non-ephemeral offline sender degrades to a delivery.log record (best-effort) — never a wake.
+        { ephemeral, noteLiveTopic },
       )
       appendDeliveryEvent(cfg.eventLogDir, {
         ev: 'composer-queue-failed-notify',
@@ -542,7 +561,7 @@ if (import.meta.main) {
   } else {
     const env = process.env
     const handle = await startConfiguredDaemon({
-      port: Number(env.IAPEER_PORT ?? DEFAULT_DAEMON_PORT),
+      port: parseDaemonPort(env.IAPEER_PORT),
       socketPath: env.IAPEER_DAEMON_SOCKET?.trim() || undefined,
       env,
     })

package/src/identity/profileStandard.ts

@@ -201,7 +201,17 @@ export function migrateProfileRuntimeField(cwd: string): boolean {
  * profile. Used by verify (compare against the live index) and reindex (rewrite it).
  */
 export function projectProfileToRecord(cwd: string): PeerRecord | null {
-  const profile = readPeerProfile(cwd)
+  // В32 — a CORRUPT local profile (invalid JSON / invalid stored field) makes readPeerProfile THROW.
+  // Unguarded, one bad profile aborts the whole reconcile/reindex map → verify crashes for all ~30 peers
+  // (with a message that does not even name the peer), and verify --fix never reaches reindex. Treat a
+  // corrupt profile like a missing one: reconcileIndex reports null drift, and reindexFromLocals PRESERVES
+  // the existing registry record (its `if (!projected) return rec`), so nothing is crashed or removed.
+  let profile
+  try {
+    profile = readPeerProfile(cwd)
+  } catch {
+    return null
+  }
   if (!profile) return null
   return {
     personality: profile.personality,

package/src/registry/index.ts

@@ -9,7 +9,7 @@
 // is no unlocked path to the registry file anywhere in the package.
 
 import * as lockfile from 'proper-lockfile'
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs'
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'fs'
 import { homedir } from 'os'
 import { join } from 'path'
 import { writeFileAtomicRaw } from '../storage/atomicWrite.ts'
@@ -345,6 +345,24 @@ function writePeersIndexAtomic(paths: PeersPaths, index: PeersIndex): void {
   writeFileAtomicRaw(paths.peersFile, `${JSON.stringify(normalized, null, 2)}\n`, 0o600, paths.tmpDir)
 }
 
+/** В33 — assert the READ invariants BEFORE publishing. writePeersIndexAtomic does no validation, so a
+ *  duplicate personality (e.g. a partial renamePeer + create, or reindex projecting two same-named local
+ *  profiles) or an empty cwd would write SUCCESSFULLY and then make EVERY readPeersIndex throw — the whole
+ *  fleet stops resolving until the file is hand-repaired. Fail LOUD here (the single-writer chokepoint) so
+ *  the on-disk file is never left unreadable. */
+function assertWritableIndex(index: PeersIndex): void {
+  const seen = new Set<string>()
+  for (const p of index.peers) {
+    if (!p.cwd || !p.cwd.trim()) {
+      throw new IapError(`refusing to write peers-profiles.json: peer "${p.personality}" has an empty cwd (would be unreadable)`)
+    }
+    if (seen.has(p.personality)) {
+      throw new IapError(`refusing to write peers-profiles.json: duplicate peer "${p.personality}" (would make the registry unreadable for the whole fleet)`)
+    }
+    seen.add(p.personality)
+  }
+}
+
 export async function updatePeersIndex(
   updater: (index: PeersIndex) => PeersIndex,
   options: PeersUpdateOptions = {},
@@ -352,6 +370,7 @@ export async function updatePeersIndex(
   return withPeersLock(options, paths => {
     const current = readPeersIndex({ ...options, rootDir: paths.rootDir })
     const next = updater(current)
+    assertWritableIndex(next) // В33 — fail before publish; the file stays readable
     writePeersIndexAtomic(paths, next)
     return next
   })
@@ -371,6 +390,17 @@ export interface UpsertPeerArgs {
   cwd: string
 }
 
+/** Two cwds refer to the SAME folder (realpath-tolerant so a symlinked path compares equal to its
+ *  target). Falls back to a literal compare when a path can't be resolved (e.g. not yet created). */
+function sameCwd(a: string, b: string): boolean {
+  if (a === b) return true
+  try {
+    return realpathSync(a) === realpathSync(b)
+  } catch {
+    return a === b
+  }
+}
+
 export async function upsertPeer(
   args: UpsertPeerArgs,
   options: PeersUpdateOptions = {},
@@ -411,6 +441,18 @@ export async function upsertPeer(
   return updatePeersIndex(index => {
     const existing = index.peers.find(peer => peer.personality === args.personality)
 
+    // В35 — re-check the personality↔cwd collision UNDER THE LOCK (closing the TOCTOU: the pre-lock
+    // snapshot check in provisionPeer can be stale by the seconds-long birth-hook window). An existing
+    // peer at a DIFFERENT folder must NOT be silently re-pointed — that splits one identity across two
+    // folders (routing goes to whichever the entry point resolves). Legitimate folder moves are
+    // fail-closed in ensurePeerProfile; renames go through renamePeer — neither re-points via upsert.
+    if (existing && !sameCwd(existing.cwd, args.cwd)) {
+      throw new IapError(
+        `peer "${args.personality}" already exists at ${existing.cwd}; refusing to re-point it to ${args.cwd} ` +
+          `(one personality = one folder — use 'iapeer rename' to move it)`,
+      )
+    }
+
     // H1 merge-with-existing: a field ABSENT from args inherits from `existing`,
     // NOT from a runtime default. The runtime default applies ONLY to a brand-new
     // peer (no existing). This is what stops a claude-boot upsert (no intelligence)