@agfpd/iapeer 0.4.41 → 0.4.43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.41",
+  "version": "0.4.43",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/identity/profileStandard.ts

@@ -201,7 +201,17 @@ export function migrateProfileRuntimeField(cwd: string): boolean {
  * profile. Used by verify (compare against the live index) and reindex (rewrite it).
  */
 export function projectProfileToRecord(cwd: string): PeerRecord | null {
-  const profile = readPeerProfile(cwd)
+  // В32 — a CORRUPT local profile (invalid JSON / invalid stored field) makes readPeerProfile THROW.
+  // Unguarded, one bad profile aborts the whole reconcile/reindex map → verify crashes for all ~30 peers
+  // (with a message that does not even name the peer), and verify --fix never reaches reindex. Treat a
+  // corrupt profile like a missing one: reconcileIndex reports null drift, and reindexFromLocals PRESERVES
+  // the existing registry record (its `if (!projected) return rec`), so nothing is crashed or removed.
+  let profile
+  try {
+    profile = readPeerProfile(cwd)
+  } catch {
+    return null
+  }
   if (!profile) return null
   return {
     personality: profile.personality,

package/src/launch/adapters/claude.ts

@@ -345,6 +345,55 @@ export const claudeAdapter: RuntimeAdapter = {
     return best.path ? lastTimestampedEntryMs(best.path) : null
   },
 
+  /**
+   * В58 — newest FILE mtime among the session's CHILD workflow/subagent transcripts, or null when there
+   * are none. Claude writes them under `~/.claude/projects/<slug>/<session-uuid>/subagents/**\/agent-*.jsonl`
+   * (a plain subagent) and `<session-uuid>/subagents/workflows/<wf>/agent-*.jsonl` (a workflow subagent),
+   * appending continuously while the child runs — so a fresh mtime here means the peer is actively
+   * driving a workflow even though it makes no turns of its OWN (lastTurnMtime is stale). superviseTick
+   * folds this into the idle proxy so a peer on a long (>1h) workflow is not idle-reaped mid-work. Bounded
+   * recursive walk; a super-fresh file (< 60s) short-circuits so the common active-workflow case is cheap.
+   */
+  childActivityMtime(cwd: string): number | null {
+    const root = transcriptDir(cwd)
+    let sessions: string[]
+    try {
+      sessions = readdirSync(root)
+    } catch {
+      return null
+    }
+    let newest = 0
+    const freshFloor = Date.now() - 60_000 // any file newer than this is "definitely active" → stop early
+    const walk = (dir: string, depth: number): boolean => {
+      if (depth > 4) return false // <session>/subagents/workflows/<wf>/agent-*.jsonl — bounded
+      let items: import('fs').Dirent[]
+      try {
+        items = readdirSync(dir, { withFileTypes: true })
+      } catch {
+        return false
+      }
+      for (const it of items) {
+        const p = join(dir, it.name)
+        if (it.isDirectory()) {
+          if (walk(p, depth + 1)) return true
+        } else if (it.isFile() && it.name.endsWith('.jsonl')) {
+          try {
+            const mt = statSync(p).mtimeMs
+            if (mt > newest) newest = mt
+            if (mt > freshFloor) return true // active work found — no need to scan the rest
+          } catch {
+            /* race — entry vanished */
+          }
+        }
+      }
+      return false
+    }
+    for (const s of sessions) {
+      if (walk(join(root, s, 'subagents'), 0)) break
+    }
+    return newest > 0 ? newest : null
+  },
+
   /**
    * Resume preflight (fail-loud — never a silent fresh fallback): resolve the
    * newest transcript uuid for cwd via the claude-slug dir scan (lifecycle.

package/src/launch/types.ts

@@ -314,6 +314,13 @@ export interface RuntimeAdapter {
    *  superviseTick uses THIS for idle/quiet age. null for a router (no transcript). */
   lastTurnMtime(cwd: string): number | null
 
+  /** В58 — newest FILE mtime among the session's CHILD workflow/subagent transcripts (a running workflow
+   *  writes them continuously). A peer that launched a long workflow (>1h) makes NO turns of its own, so
+   *  lastTurnMtime is stale and the idle-reap would cut the busy session mid-work. superviseTick folds
+   *  THIS into the idle proxy so live child work keeps the session alive. Optional — null / undefined for
+   *  runtimes without a subagent layout (routers, codex). */
+  childActivityMtime?(cwd: string): number | null
+
   /** Resume preflight — validate a resume request fail-loud (never silent fresh).
    *  Returns the resolved ref (claude uuid) or ok:false with a reason. */
   resolveResume(cwd: string): { ok: boolean; ref?: string; reason?: string }

package/src/lifecycle/index.ts

@@ -1237,6 +1237,9 @@ export interface SuperviseDeps {
    *  idle) and NOT the pane-log mtime (a statusline re-render ticks it at idle); both falsely keep an
    *  idle session young. Tests inject a controlled value to exercise the idle/quiet age hermetically. */
   lastTurnMtime?: (runtime: string, cwd: string) => number | null
+  /** В58 — child workflow/subagent activity seam (default: the adapter's childActivityMtime). Folded into
+   *  the idle proxy so a peer driving a long workflow (no turns of its own) is not reaped mid-work. */
+  childActivityMtime?: (runtime: string, cwd: string) => number | null
   /** Liveness seam (default: the real `sessionAlive` = pty-host pid-file check). Tests inject a fixed
    *  verdict so the idle path is exercised hermetically — no live pty session needed. */
   sessionAlive?: (sock: string, identity: string) => boolean
@@ -1251,6 +1254,7 @@ interface SuperviseCtx {
   env: NodeJS.ProcessEnv
   nowMs: number
   lastTurnMt: (runtime: string, cwd: string) => number | null
+  childActivityMt: (runtime: string, cwd: string) => number | null
   isAlive: (sock: string, identity: string) => boolean
   kill: (sock: string, identity: string) => void
   verbose: boolean
@@ -1265,7 +1269,7 @@ interface SuperviseCtx {
  * returns exactly one outcome; the trace side-effects mirror the prior inline behaviour.
  */
 function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome {
-  const { cfg, env, nowMs, lastTurnMt, isAlive, kill, verbose, trace } = ctx
+  const { cfg, env, nowMs, lastTurnMt, childActivityMt, isAlive, kill, verbose, trace } = ctx
   // H4 — FIRST, before any reap. A launchd-managed peer is read-only.
   if (isLaunchdManaged(s.personality, env)) {
     if (verbose) trace({ identity: s.identity, action: 'skipped-launchd', outcome: 'read-only-h4' })
@@ -1356,11 +1360,18 @@ function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome
   const ephemeral = isEphemeralPeer(s.cwd)
   let lt = 0
   try { lt = lastTurnMt(s.runtime, s.cwd) ?? 0 } catch { /* unreadable → wokeAt floor */ }
+  // В58 — fold in CHILD workflow/subagent activity. A peer driving a long (>1h) workflow makes NO turns
+  // of its own, so lt is stale; without this the busy-with-workflow session is idle-reaped mid-work (live
+  // incident: iapeer-memory cut mid-audit). A running workflow writes its subagent transcripts
+  // continuously → their fresh mtime is genuine activity. Only RAISES the floor (never keeps a truly idle
+  // session alive: a finished workflow's files are old).
+  let childMt = 0
+  try { childMt = childActivityMt(s.runtime, s.cwd) ?? 0 } catch { /* no subagent layout → ignored */ }
   // В7 — fold in the last CONFIRMED live delivery. A message delivered just as the session crosses
   // idleSecs (codex acks BEFORE it writes the turn record) would otherwise be reaped out from under the
   // just-delivered message before lt catches up — a silent loss behind ok:true. lastDelivered only ever
   // RAISES the floor (a delivery is activity), so it can never keep a genuinely idle session alive.
-  const mt = Math.max(lt, s.wokeAt, readLastDelivered(cfg, s.identity))
+  const mt = Math.max(lt, s.wokeAt, childMt, readLastDelivered(cfg, s.identity))
   const ageSecs = Math.floor((nowMs - mt) / 1000)
   // wake_policy:ephemeral M2 — die-after-reply: an ARMED ephemeral session (the
   // daemon routed its outbound reply) is reaped after a QUIET window, checked
@@ -1431,6 +1442,8 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
   const env = deps.env ?? process.env
   const nowMs = deps.nowMs ?? Date.now()
   const lastTurnMt = deps.lastTurnMtime ?? ((rt: string, c: string) => getAdapter(rt as Runtime).lastTurnMtime(c))
+  const childActivityMt =
+    deps.childActivityMtime ?? ((rt: string, c: string) => getAdapter(rt as Runtime).childActivityMtime?.(c) ?? null)
   // Default seams bind the injected env so a sandboxed tick never reads/kills the real fleet.
   const isAlive = deps.sessionAlive ?? ((sock: string, identity: string) => sessionAlive(sock, identity, env))
   const kill = deps.killSession ?? ((sock: string, identity: string) => killSession(sock, identity, env))
@@ -1450,7 +1463,7 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
   const trace = (fields: Record<string, string | number | undefined>): void =>
     appendLifecycleEvent(cfg.eventLogDir, { ev: 'supervise', ...fields }, { env, nowMs })
   const out: SuperviseOutcome[] = []
-  const ctx: SuperviseCtx = { cfg, env, nowMs, lastTurnMt, isAlive, kill, verbose, trace }
+  const ctx: SuperviseCtx = { cfg, env, nowMs, lastTurnMt, childActivityMt, isAlive, kill, verbose, trace }
   for (const s of readSessionStates(cfg)) {
     // Per-peer ISOLATION: a throw while evaluating ONE peer must NOT abort the whole sweep — that is
     // the silent fleet-wide reap-outage class (one malformed peer-state and NO peer gets reaped, the

package/src/registry/index.ts

@@ -9,7 +9,7 @@
 // is no unlocked path to the registry file anywhere in the package.
 
 import * as lockfile from 'proper-lockfile'
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs'
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'fs'
 import { homedir } from 'os'
 import { join } from 'path'
 import { writeFileAtomicRaw } from '../storage/atomicWrite.ts'
@@ -345,6 +345,24 @@ function writePeersIndexAtomic(paths: PeersPaths, index: PeersIndex): void {
   writeFileAtomicRaw(paths.peersFile, `${JSON.stringify(normalized, null, 2)}\n`, 0o600, paths.tmpDir)
 }
 
+/** В33 — assert the READ invariants BEFORE publishing. writePeersIndexAtomic does no validation, so a
+ *  duplicate personality (e.g. a partial renamePeer + create, or reindex projecting two same-named local
+ *  profiles) or an empty cwd would write SUCCESSFULLY and then make EVERY readPeersIndex throw — the whole
+ *  fleet stops resolving until the file is hand-repaired. Fail LOUD here (the single-writer chokepoint) so
+ *  the on-disk file is never left unreadable. */
+function assertWritableIndex(index: PeersIndex): void {
+  const seen = new Set<string>()
+  for (const p of index.peers) {
+    if (!p.cwd || !p.cwd.trim()) {
+      throw new IapError(`refusing to write peers-profiles.json: peer "${p.personality}" has an empty cwd (would be unreadable)`)
+    }
+    if (seen.has(p.personality)) {
+      throw new IapError(`refusing to write peers-profiles.json: duplicate peer "${p.personality}" (would make the registry unreadable for the whole fleet)`)
+    }
+    seen.add(p.personality)
+  }
+}
+
 export async function updatePeersIndex(
   updater: (index: PeersIndex) => PeersIndex,
   options: PeersUpdateOptions = {},
@@ -352,6 +370,7 @@ export async function updatePeersIndex(
   return withPeersLock(options, paths => {
     const current = readPeersIndex({ ...options, rootDir: paths.rootDir })
     const next = updater(current)
+    assertWritableIndex(next) // В33 — fail before publish; the file stays readable
     writePeersIndexAtomic(paths, next)
     return next
   })
@@ -371,6 +390,17 @@ export interface UpsertPeerArgs {
   cwd: string
 }
 
+/** Two cwds refer to the SAME folder (realpath-tolerant so a symlinked path compares equal to its
+ *  target). Falls back to a literal compare when a path can't be resolved (e.g. not yet created). */
+function sameCwd(a: string, b: string): boolean {
+  if (a === b) return true
+  try {
+    return realpathSync(a) === realpathSync(b)
+  } catch {
+    return a === b
+  }
+}
+
 export async function upsertPeer(
   args: UpsertPeerArgs,
   options: PeersUpdateOptions = {},
@@ -411,6 +441,18 @@ export async function upsertPeer(
   return updatePeersIndex(index => {
     const existing = index.peers.find(peer => peer.personality === args.personality)
 
+    // В35 — re-check the personality↔cwd collision UNDER THE LOCK (closing the TOCTOU: the pre-lock
+    // snapshot check in provisionPeer can be stale by the seconds-long birth-hook window). An existing
+    // peer at a DIFFERENT folder must NOT be silently re-pointed — that splits one identity across two
+    // folders (routing goes to whichever the entry point resolves). Legitimate folder moves are
+    // fail-closed in ensurePeerProfile; renames go through renamePeer — neither re-points via upsert.
+    if (existing && !sameCwd(existing.cwd, args.cwd)) {
+      throw new IapError(
+        `peer "${args.personality}" already exists at ${existing.cwd}; refusing to re-point it to ${args.cwd} ` +
+          `(one personality = one folder — use 'iapeer rename' to move it)`,
+      )
+    }
+
     // H1 merge-with-existing: a field ABSENT from args inherits from `existing`,
     // NOT from a runtime default. The runtime default applies ONLY to a brand-new
     // peer (no existing). This is what stops a claude-boot upsert (no intelligence)