@agfpd/iapeer 0.4.42 → 0.4.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.42",
+  "version": "0.4.44",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/identity/index.ts

@@ -6,7 +6,7 @@
 // wipe description without an explicit new value). Path helpers moved to storage.
 
 import { basename, join, resolve } from 'path'
-import { existsSync, readFileSync, realpathSync } from 'fs'
+import { existsSync, mkdirSync, readFileSync, realpathSync, rmdirSync, statSync } from 'fs'
 import {
   IAPEER_DIR,
   PEER_PROFILE_FILE,
@@ -251,10 +251,64 @@ export function readPeerProfile(cwd: string = process.cwd()): PeerProfile | null
  * The profile file (basename peer-profile.json) is allowed through
  * storage.writeFileAtomic; only peers-profiles.json is guarded there.
  */
+const PROFILE_LOCK_WAIT_MS = 2000
+const PROFILE_LOCK_STALE_MS = 10_000
+
+/** В31 — serialize the read-merge-write of a peer's local profile so concurrent FOUNDATION writers
+ *  (verify --fix, the `default-runtime` verb, ensurePeerProfile at re-provision) don't lose each other's
+ *  owner sections via a read-modify-write race. A sync mkdir-lock: writePeerProfileAtomic is sync and off
+ *  the delivery hot path (rare operator calls). Best-effort — a stale lock is reclaimed, and on timeout it
+ *  proceeds WITHOUT the lock so it can never deadlock. CROSS-PACKAGE CAVEAT: telegram-runtime writes this
+ *  file with its OWN code and does not take this lock; full safety needs it to adopt the same lock (a
+ *  separate cross-package contract — this closes the foundation-vs-foundation window). */
+function withProfileLockSync<T>(cwd: string, fn: () => T): T {
+  const lockDir = join(cwd, '.iapeer', '.peer-profile.lock')
+  const deadline = Date.now() + PROFILE_LOCK_WAIT_MS
+  let held = false
+  for (;;) {
+    try {
+      mkdirSync(lockDir)
+      held = true
+      break
+    } catch (e) {
+      if ((e as NodeJS.ErrnoException).code !== 'EEXIST') break // fs issue → proceed unlocked (best-effort)
+      try {
+        if (Date.now() - statSync(lockDir).mtimeMs > PROFILE_LOCK_STALE_MS) {
+          rmdirSync(lockDir)
+          continue // reclaimed a crashed writer's stale lock → retry immediately
+        }
+      } catch {
+        /* the lock vanished between checks — retry */
+      }
+      if (Date.now() > deadline) break // give up waiting → proceed unlocked (never deadlock)
+      try {
+        ;(globalThis as { Bun?: { sleepSync(ms: number): void } }).Bun?.sleepSync(15)
+      } catch {
+        /* */
+      }
+    }
+  }
+  try {
+    return fn()
+  } finally {
+    if (held)
+      try {
+        rmdirSync(lockDir)
+      } catch {
+        /* */
+      }
+  }
+}
+
 export function writePeerProfileAtomic(cwd: string, profile: PeerProfileWrite): void {
   ensureLocalIapScaffold(cwd)
   const path = peerProfilePath(cwd)
+  // В31 — the ENTIRE read-merge-write runs under the per-cwd lock so a concurrent foundation writer's
+  // owner sections are never clobbered by a stale-read merge.
+  withProfileLockSync(cwd, () => writePeerProfileMerged(path, profile))
+}
 
+function writePeerProfileMerged(path: string, profile: PeerProfileWrite): void {
   let existing: Record<string, unknown> = {}
   try {
     const parsed = JSON.parse(readFileSync(path, 'utf8'))

package/src/launch/adapters/claude.ts

@@ -345,6 +345,55 @@ export const claudeAdapter: RuntimeAdapter = {
     return best.path ? lastTimestampedEntryMs(best.path) : null
   },
 
+  /**
+   * В58 — newest FILE mtime among the session's CHILD workflow/subagent transcripts, or null when there
+   * are none. Claude writes them under `~/.claude/projects/<slug>/<session-uuid>/subagents/**\/agent-*.jsonl`
+   * (a plain subagent) and `<session-uuid>/subagents/workflows/<wf>/agent-*.jsonl` (a workflow subagent),
+   * appending continuously while the child runs — so a fresh mtime here means the peer is actively
+   * driving a workflow even though it makes no turns of its OWN (lastTurnMtime is stale). superviseTick
+   * folds this into the idle proxy so a peer on a long (>1h) workflow is not idle-reaped mid-work. Bounded
+   * recursive walk; a super-fresh file (< 60s) short-circuits so the common active-workflow case is cheap.
+   */
+  childActivityMtime(cwd: string): number | null {
+    const root = transcriptDir(cwd)
+    let sessions: string[]
+    try {
+      sessions = readdirSync(root)
+    } catch {
+      return null
+    }
+    let newest = 0
+    const freshFloor = Date.now() - 60_000 // any file newer than this is "definitely active" → stop early
+    const walk = (dir: string, depth: number): boolean => {
+      if (depth > 4) return false // <session>/subagents/workflows/<wf>/agent-*.jsonl — bounded
+      let items: import('fs').Dirent[]
+      try {
+        items = readdirSync(dir, { withFileTypes: true })
+      } catch {
+        return false
+      }
+      for (const it of items) {
+        const p = join(dir, it.name)
+        if (it.isDirectory()) {
+          if (walk(p, depth + 1)) return true
+        } else if (it.isFile() && it.name.endsWith('.jsonl')) {
+          try {
+            const mt = statSync(p).mtimeMs
+            if (mt > newest) newest = mt
+            if (mt > freshFloor) return true // active work found — no need to scan the rest
+          } catch {
+            /* race — entry vanished */
+          }
+        }
+      }
+      return false
+    }
+    for (const s of sessions) {
+      if (walk(join(root, s, 'subagents'), 0)) break
+    }
+    return newest > 0 ? newest : null
+  },
+
   /**
    * Resume preflight (fail-loud — never a silent fresh fallback): resolve the
    * newest transcript uuid for cwd via the claude-slug dir scan (lifecycle.

package/src/launch/types.ts

@@ -314,6 +314,13 @@ export interface RuntimeAdapter {
    *  superviseTick uses THIS for idle/quiet age. null for a router (no transcript). */
   lastTurnMtime(cwd: string): number | null
 
+  /** В58 — newest FILE mtime among the session's CHILD workflow/subagent transcripts (a running workflow
+   *  writes them continuously). A peer that launched a long workflow (>1h) makes NO turns of its own, so
+   *  lastTurnMtime is stale and the idle-reap would cut the busy session mid-work. superviseTick folds
+   *  THIS into the idle proxy so live child work keeps the session alive. Optional — null / undefined for
+   *  runtimes without a subagent layout (routers, codex). */
+  childActivityMtime?(cwd: string): number | null
+
   /** Resume preflight — validate a resume request fail-loud (never silent fresh).
    *  Returns the resolved ref (claude uuid) or ok:false with a reason. */
   resolveResume(cwd: string): { ok: boolean; ref?: string; reason?: string }

package/src/lifecycle/index.ts

@@ -1237,6 +1237,9 @@ export interface SuperviseDeps {
    *  idle) and NOT the pane-log mtime (a statusline re-render ticks it at idle); both falsely keep an
    *  idle session young. Tests inject a controlled value to exercise the idle/quiet age hermetically. */
   lastTurnMtime?: (runtime: string, cwd: string) => number | null
+  /** В58 — child workflow/subagent activity seam (default: the adapter's childActivityMtime). Folded into
+   *  the idle proxy so a peer driving a long workflow (no turns of its own) is not reaped mid-work. */
+  childActivityMtime?: (runtime: string, cwd: string) => number | null
   /** Liveness seam (default: the real `sessionAlive` = pty-host pid-file check). Tests inject a fixed
    *  verdict so the idle path is exercised hermetically — no live pty session needed. */
   sessionAlive?: (sock: string, identity: string) => boolean
@@ -1251,6 +1254,7 @@ interface SuperviseCtx {
   env: NodeJS.ProcessEnv
   nowMs: number
   lastTurnMt: (runtime: string, cwd: string) => number | null
+  childActivityMt: (runtime: string, cwd: string) => number | null
   isAlive: (sock: string, identity: string) => boolean
   kill: (sock: string, identity: string) => void
   verbose: boolean
@@ -1265,7 +1269,7 @@ interface SuperviseCtx {
  * returns exactly one outcome; the trace side-effects mirror the prior inline behaviour.
  */
 function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome {
-  const { cfg, env, nowMs, lastTurnMt, isAlive, kill, verbose, trace } = ctx
+  const { cfg, env, nowMs, lastTurnMt, childActivityMt, isAlive, kill, verbose, trace } = ctx
   // H4 — FIRST, before any reap. A launchd-managed peer is read-only.
   if (isLaunchdManaged(s.personality, env)) {
     if (verbose) trace({ identity: s.identity, action: 'skipped-launchd', outcome: 'read-only-h4' })
@@ -1356,11 +1360,18 @@ function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome
   const ephemeral = isEphemeralPeer(s.cwd)
   let lt = 0
   try { lt = lastTurnMt(s.runtime, s.cwd) ?? 0 } catch { /* unreadable → wokeAt floor */ }
+  // В58 — fold in CHILD workflow/subagent activity. A peer driving a long (>1h) workflow makes NO turns
+  // of its own, so lt is stale; without this the busy-with-workflow session is idle-reaped mid-work (live
+  // incident: iapeer-memory cut mid-audit). A running workflow writes its subagent transcripts
+  // continuously → their fresh mtime is genuine activity. Only RAISES the floor (never keeps a truly idle
+  // session alive: a finished workflow's files are old).
+  let childMt = 0
+  try { childMt = childActivityMt(s.runtime, s.cwd) ?? 0 } catch { /* no subagent layout → ignored */ }
   // В7 — fold in the last CONFIRMED live delivery. A message delivered just as the session crosses
   // idleSecs (codex acks BEFORE it writes the turn record) would otherwise be reaped out from under the
   // just-delivered message before lt catches up — a silent loss behind ok:true. lastDelivered only ever
   // RAISES the floor (a delivery is activity), so it can never keep a genuinely idle session alive.
-  const mt = Math.max(lt, s.wokeAt, readLastDelivered(cfg, s.identity))
+  const mt = Math.max(lt, s.wokeAt, childMt, readLastDelivered(cfg, s.identity))
   const ageSecs = Math.floor((nowMs - mt) / 1000)
   // wake_policy:ephemeral M2 — die-after-reply: an ARMED ephemeral session (the
   // daemon routed its outbound reply) is reaped after a QUIET window, checked
@@ -1431,6 +1442,8 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
   const env = deps.env ?? process.env
   const nowMs = deps.nowMs ?? Date.now()
   const lastTurnMt = deps.lastTurnMtime ?? ((rt: string, c: string) => getAdapter(rt as Runtime).lastTurnMtime(c))
+  const childActivityMt =
+    deps.childActivityMtime ?? ((rt: string, c: string) => getAdapter(rt as Runtime).childActivityMtime?.(c) ?? null)
   // Default seams bind the injected env so a sandboxed tick never reads/kills the real fleet.
   const isAlive = deps.sessionAlive ?? ((sock: string, identity: string) => sessionAlive(sock, identity, env))
   const kill = deps.killSession ?? ((sock: string, identity: string) => killSession(sock, identity, env))
@@ -1450,7 +1463,7 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
   const trace = (fields: Record<string, string | number | undefined>): void =>
     appendLifecycleEvent(cfg.eventLogDir, { ev: 'supervise', ...fields }, { env, nowMs })
   const out: SuperviseOutcome[] = []
-  const ctx: SuperviseCtx = { cfg, env, nowMs, lastTurnMt, isAlive, kill, verbose, trace }
+  const ctx: SuperviseCtx = { cfg, env, nowMs, lastTurnMt, childActivityMt, isAlive, kill, verbose, trace }
   for (const s of readSessionStates(cfg)) {
     // Per-peer ISOLATION: a throw while evaluating ONE peer must NOT abort the whole sweep — that is
     // the silent fleet-wide reap-outage class (one malformed peer-state and NO peer gets reaped, the

package/src/registry/index.ts

@@ -490,7 +490,13 @@ export async function upsertPeer(
 
     const record: PeerRecord = {
       personality: args.personality,
-      runtime, // args.runtime wins — caller knows the current runtime
+      // В34 — default_runtime is an H1 field: it INHERITS from existing, it does NOT flip to args.runtime.
+      // A re-provision / `init --runtime codex` on an existing claude-default peer ADDS codex to runtimes
+      // (below) but must NOT silently make codex the default — that mis-wakes the peer on the wrong
+      // runtime until the next reindex heals it (which never runs when addRuntime returns 'already'). The
+      // default changes ONLY via the explicit `default-runtime` verb (writes the local profile +
+      // reindexFromLocals). A brand-new peer (no existing) naturally takes args.runtime as its default.
+      runtime: existing ? existing.runtime : runtime,
       runtimes,
       description,
       intelligence,