@agfpd/iapeer 0.4.44 → 0.4.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.44",
+  "version": "0.4.46",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/daemon/index.ts

@@ -200,6 +200,9 @@ function errResult(text: string): ToolResult {
 /** Injected seams for callTool — all OPTIONAL, all wired by the composition point
  *  (daemon/main.ts); library/test callers omit them and stay hermetic. */
 export interface CallToolDeps {
+  /** Б7 — injected env for the request-path registry read + routeSend (daemon:286 isolation). Default
+   *  process.env; the production daemon threads its startDaemon env here. */
+  env?: NodeJS.ProcessEnv
   /** Wake-on-miss primitive (Ф2) — see StartDaemonOptions.wake. */
   wake?: WakeFn
   /** Per-delivery outcome log dir (Ф-#8a) — see StartDaemonOptions.deliveryLogDir. */
@@ -243,6 +246,7 @@ export async function callTool(
     }
     const t0 = Date.now()
     const sent = await routeSend(caller, input, {
+      env: deps.env,
       wake: deps.wake,
       ephemeral: deps.ephemeral,
       noteLiveTopic: deps.noteLiveTopic,
@@ -311,7 +315,7 @@ export function createMcpServer(deps: CallToolDeps = {}): Server {
     const headerIdentity = headerFromRequestInfo(extra as never)
     let caller: ResolvedCaller
     try {
-      caller = resolveCallerFromHeader(headerIdentity, readPeersIndex())
+      caller = resolveCallerFromHeader(headerIdentity, readPeersIndex({ env: deps.env }))
     } catch (e) {
       // No silent default — reject the CallTool when identity is missing/invalid.
       if (process.env.IAPEER_DAEMON_LOG) {
@@ -459,6 +463,7 @@ export async function startDaemon(opts: StartDaemonOptions = {}): Promise<Daemon
       return
     }
     const server = createMcpServer({
+      env: opts.env, // Б7 — thread the daemon's storage env into the request path (registry read + routeSend)
       wake: opts.wake,
       deliveryLogDir: opts.deliveryLogDir,
       onDelivered: opts.onDelivered,

package/src/launch/adapters/claude.ts

@@ -66,16 +66,38 @@ const CLAUDE_BOOT_DIALOG_MARKERS = [
   // lowercase "bypass permissions on" (a DISTINCT string), so this marker vanishes —
   // it never falsely traps isInputReady, and a re-launch is dialog-free (verified).
   'Bypass Permissions mode',
-  // Project MCP-server approval ("N new MCP servers found in this project", servers
-  // pre-checked [✔]) — shown when cwd carries a .mcp.json the config has not yet
-  // approved. Suppressed at the source by enableAllProjectMcpServers in
-  // <cwd>/.claude/settings.json (init writes it); bootDialogKeys Enter-confirms it as
-  // a backstop. Substring matches both "1 new MCP server" and "N new MCP servers".
-  'new MCP server',
 ] as const
 
+// В39 — Project MCP-server approval ("N new MCP servers found in this project", servers pre-checked
+// [✔]). This one is NOT a plain substring marker: agents on this fleet mention "new MCP server" in
+// NORMAL conversation, and a resumed session replays that tail into the viewport → the old substring
+// gated isInputReady forever, the wake failed 'never-became-ready', the message was lost (live
+// incident). Require the dialog's DISTINGUISHING context ("found in this project") too — a
+// conversational mention of the topic phrase does not carry it. Suppressed at the source by
+// enableAllProjectMcpServers (init); Enter-confirmed here as a backstop.
+function mcpApprovalActive(pane: string): boolean {
+  return pane.includes('new MCP server') && pane.includes('found in')
+}
+
 function anyBootDialog(pane: string): boolean {
-  return CLAUDE_BOOT_DIALOG_MARKERS.some(m => pane.includes(m))
+  return CLAUDE_BOOT_DIALOG_MARKERS.some(m => pane.includes(m)) || mcpApprovalActive(pane)
+}
+
+// В40 — the fullscreen-renderer nag needles are BUILT from fragments so this SOURCE FILE never contains
+// the verbatim modal text. A nag-watcher reads a peer's live VIEWPORT; if this file's text (a peer
+// editing/reviewing it) carried the contiguous phrase, viewing it would self-trigger the very bug — which
+// is exactly what happened live while this fix was being written. Split literals keep the match working at
+// runtime while making the source inert.
+const NAG_TITLE = 'Try the new fullscreen render' + 'er?'
+const NAG_OPTION_YES = 'Yes, ' + 'try it'
+/** Does the pane carry the fullscreen-renderer nag at all (cheap gate)? */
+function isFullscreenNagText(pane: string): boolean {
+  return pane.includes(NAG_TITLE)
+}
+/** Is THIS row the modal's LIVE selected option (cursor `❯` on "1. Yes, try it")? The bottom-most `❯`
+ *  row of a live modal is this; a mere quote of the modal has the ready composer `❯` below it instead. */
+function isFullscreenNagOptionRow(row: string): boolean {
+  return row.includes('❯') && (row.includes(NAG_OPTION_YES) || /❯\s*1\.\s*Yes/.test(row))
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -226,10 +248,10 @@ export const claudeAdapter: RuntimeAdapter = {
       pane.includes('trust this folder') ||
       pane.includes('Allow external CLAUDE.md file imports?') ||
       pane.includes('I am using this for local development') ||
-      // Project MCP-server approval (servers pre-checked [✔]; Enter confirms, Esc
-      // rejects all). enableAllProjectMcpServers normally suppresses it; this is the
-      // backstop. Matches both "1 new MCP server" and "N new MCP servers".
-      pane.includes('new MCP server') ||
+      // Project MCP-server approval (servers pre-checked [✔]; Enter confirms, Esc rejects all).
+      // enableAllProjectMcpServers normally suppresses it; this is the backstop. В39: full-signature
+      // (topic + "found in") so a conversational mention never triggers a stray Enter.
+      mcpApprovalActive(pane) ||
       // First-run theme picker (clean host): the default-highlighted row is always a
       // valid theme (any choice is harmless for a headless peer), so a bare Enter
       // accepts it. Without this the picker blocks the boot forever on a fresh host.
@@ -246,35 +268,35 @@ export const claudeAdapter: RuntimeAdapter = {
   },
 
   /**
-   * MID-SESSION nag/upsell auto-dismiss (livability — distinct from bootDialogKeys,
-   * which the supervisor drives only until ready). claude pops a ONE-TIME interactive
-   * upsell modal AFTER the session is live that BLOCKS a headless peer (no human to
-   * answer):
-   *
-   *     Try the new fullscreen renderer?
-   *     · Flicker-free output …
-   *     ❯ 1. Yes, try it
-   *       2. Not now
-   *     Enter to confirm · Esc to cancel
+   * MID-SESSION nag/upsell auto-dismiss (livability — distinct from bootDialogKeys, which the supervisor
+   * drives only until ready). claude pops a ONE-TIME interactive upsell modal AFTER the session is live —
+   * the fullscreen-renderer offer — that BLOCKS a headless peer (no human to answer). Its default cursor
+   * is on the ACCEPT option, so a bare Enter would enable the alt-screen renderer and change the surface
+   * the pane-log model / composer-occupancy / ready-gate all read off. We DECLINE by selecting the "not
+   * now" option ('2' then Enter — '2' is emitted verbatim, not a named key). VERIFIED-SAFE on the live
+   * fleet ('2'+Enter cleared it on boris/doc; an arrow-step+Enter mis-fired into fullscreen on scriber; Esc/
+   * 'n' unverified) — so this is the ONLY accepted sequence.
    *
-   * The default cursor sits on "1. Yes, try it", so a BARE Enter would ENABLE the
-   * fullscreen renderer — which switches claude to the alt-screen TUI and changes the
-   * surface the pane-log model + composer-occupancy + ready-gate all read off. We must
-   * DECLINE: type the literal '2' then Enter ('2','Enter' → "2\r"; '2' is not a named/
-   * cursor key, so it is emitted verbatim without a `-l` literal switch — and `-l`
-   * would wrongly make the following 'Enter' literal too). VERIFIED-SAFE on the live
-   * fleet: '2'+Enter cleared the modal on boris and doc and returned them to the
-   * composer; an arrow-step+Enter MIS-FIRED into "tui":"fullscreen" on scriber, and Esc/
-   * 'n' are unverified — so this is the ONLY accepted sequence. Match the FULL signature
-   * (title AND the "2. Not now" decline row) so a transcript merely DISCUSSING the
-   * fullscreen renderer can never trigger a stray keystroke. Future one-time CC upsells
-   * of this class extend the match here (each with its own verified-safe decline key).
+   * В40 — the match is POSITION-based, NOT phrase-based: the needles are built from fragments (this file
+   * never carries the verbatim modal text, or a peer editing/reviewing it would self-trigger — observed
+   * live), and it fires ONLY when the BOTTOM-MOST cursor row is the modal's live option (a mere quote of
+   * the modal has the ready composer below it). NB text-matching still cannot fully distinguish a live
+   * claude modal from an agent RENDERING the modal glyphs at its viewport bottom — the correct fix is a
+   * rendering-level signal (the alt-screen switch), tracked as a HIGH-priority follow-up (В59).
    */
   nagDismissKeys(pane: string): string[] | null {
-    if (pane.includes('Try the new fullscreen renderer?') && pane.includes('2. Not now')) {
-      return ['2', 'Enter']
-    }
-    return null
+    // В40 — a text-only match fired '2'+Enter into a LIVE composer whenever the peer merely displayed the
+    // modal text (a code review of this file, a forwarded bug report — or, live-observed, the peer editing
+    // THIS adapter). Discriminate by POSITION, not phrases: claude's live modal REPLACES the composer, so
+    // the BOTTOM-MOST cursor row (`❯`) sits on the modal's option. A mere quote of the modal has the READY
+    // composer `❯` rendered BELOW it as the bottom-most cursor row. So: fire only when the last `❯`-bearing
+    // row is the modal's selected option — a displayed quote never is.
+    if (!isFullscreenNagText(pane)) return null
+    let lastCursorRow = ''
+    for (const line of pane.split(/\r?\n/)) if (line.includes('❯')) lastCursorRow = line
+    // the live modal's bottom-most cursor sits on option 1 ("Yes, try it"); the ready composer's `❯` does
+    // not carry the option text, so a quote (composer below) fails this.
+    return isFullscreenNagOptionRow(lastCursorRow) ? ['2', 'Enter'] : null
   },
 
   /**

package/src/transport/index.ts

@@ -107,8 +107,11 @@ export function resolveDeliveryTarget(args: {
   personality: string
   runtime?: string
   sockDir?: string
+  /** Б7 — injected env sandboxes the liveness reads (supervisor run-dir); default process.env (prod). */
+  env?: NodeJS.ProcessEnv
 }): Result<DeliveryTarget> {
-  const sockDir = args.sockDir ?? resolveSockDir()
+  const env = args.env ?? process.env
+  const sockDir = args.sockDir ?? resolveSockDir(env)
   if (!isValidName(args.personality)) {
     return err(`invalid personality "${args.personality}" — must match /^[a-z][a-z0-9-]{0,31}$/`)
   }
@@ -117,12 +120,12 @@ export function resolveDeliveryTarget(args: {
     const runtime = args.runtime
     const socketPath = buildSocketPath(runtime, args.personality, sockDir)
     const address = buildProcessAddress(runtime, args.personality)
-    if (!sessionAlive(socketPath, address)) {
+    if (!sessionAlive(socketPath, address, env)) {
       return err(`peer offline: ${args.personality} (${args.runtime})`)
     }
     return ok({ runtime, personality: args.personality, address, socketPath })
   }
-  const matches = listOnlinePeers(sockDir).filter(peer => peer.personality === args.personality)
+  const matches = listOnlinePeers(sockDir, env).filter(peer => peer.personality === args.personality)
   if (matches.length === 0) return err(`peer offline: ${args.personality}`)
   if (matches.length > 1) {
     return err(
@@ -145,13 +148,14 @@ export function resolvePeerDeliveryTarget(
   personality: string,
   runtime: string | undefined,
   peer: PeerRecord,
+  env: NodeJS.ProcessEnv = process.env,
 ): Result<DeliveryTarget> {
-  if (runtime) return resolveDeliveryTarget({ personality, runtime })
+  if (runtime) return resolveDeliveryTarget({ personality, runtime, env })
   if (peer.runtime) {
-    const exactDefault = resolveDeliveryTarget({ personality, runtime: peer.runtime })
+    const exactDefault = resolveDeliveryTarget({ personality, runtime: peer.runtime, env })
     if (exactDefault.ok) return exactDefault
   }
-  return resolveDeliveryTarget({ personality })
+  return resolveDeliveryTarget({ personality, env })
 }
 
 // Confirm poll interval — how often deliverViaHost re-reads the transcript for a NEW record carrying
@@ -232,13 +236,14 @@ export async function deliverWarm(
   envelope: string,
   cwd?: string,
   seam: WarmDeliverSeam = {},
+  env: NodeJS.ProcessEnv = process.env,
 ): Promise<Result<void>> {
   const address = target.address
   const prev = deliverTails.get(address) ?? Promise.resolve()
   // run AFTER prev settles (success or failure) — a prior delivery's error must not stall the chain
   const run = prev.then(
-    () => deliverViaHost(target, envelope, cwd, seam),
-    () => deliverViaHost(target, envelope, cwd, seam),
+    () => deliverViaHost(target, envelope, cwd, seam, env),
+    () => deliverViaHost(target, envelope, cwd, seam, env),
   )
   deliverTails.set(
     address,
@@ -255,6 +260,7 @@ async function deliverViaHost(
   envelope: string,
   cwd: string | undefined,
   seam: WarmDeliverSeam,
+  env: NodeJS.ProcessEnv = process.env,
 ): Promise<Result<void>> {
   const adapter = getAdapter(target.runtime)
   // Baseline the transcript/session-jsonl file SIZES BEFORE delivery (per-runtime candidate files).
@@ -264,8 +270,9 @@ async function deliverViaHost(
   // socket-ack runtimes (codex) return before it — computing it for them recursively scanned all of
   // ~/.codex/sessions (full-file read per session) on every delivery for nothing.
   const usesBaseline = adapter.kind !== 'router' && adapter.deliveryConfirm !== 'socket-ack'
-  const baseline = cwd && usesBaseline ? compactDoneBaseline(target.runtime, cwd) : null
-  const send = seam.deliverHosted ?? deliverHosted
+  const baseline = cwd && usesBaseline ? compactDoneBaseline(target.runtime, cwd, { env }) : null
+  // Б7 — the default deliverHosted resolves the supervisor run-dir from env (sandboxed under a test root).
+  const send = seam.deliverHosted ?? ((identity: string, msg: string) => deliverHosted(identity, msg, env))
   const sent = await send(target.address, envelope)
   if (!sent.ok) {
     return err(
@@ -892,6 +899,11 @@ export interface ComposerQueueRouteDeps {
 }
 
 export interface RouteDeps {
+  /** Б7 — injected env sandboxes ALL of routeSend's env-resolved reads (the registry, the supervisor
+   *  run-dir liveness/delivery). Default process.env (prod: env === process.env). Closes the daemon:286
+   *  isolation invariant — a library/test daemon with an injected root no longer reads the real registry
+   *  or the real fleet's live sessions. */
+  env?: NodeJS.ProcessEnv
   /** On a miss, wake the dead peer instead of returning offline (Ф2). */
   wake?: WakeFn
   /** Ephemeral-target serial-queue delivery (M3); absent → normal routing. */
@@ -1275,7 +1287,8 @@ export async function routeSend(
     return err(`message exceeds ${MAX_MESSAGE_LEN} char limit (got ${message.length})`)
   }
 
-  const index = readPeersIndex()
+  const env = deps.env ?? process.env
+  const index = readPeersIndex({ env })
   const peer = findPeer(index, personality)
   if (!peer) {
     return err(`peer "${personality}" is not in the iapeer peers index; message NOT delivered`)
@@ -1309,7 +1322,7 @@ export async function routeSend(
     return deps.ephemeral.deliver({ peer, envelope, topic, runtime })
   }
 
-  const target = resolvePeerDeliveryTarget(personality, runtime, peer)
+  const target = resolvePeerDeliveryTarget(personality, runtime, peer, env)
   if (target.ok) {
     if (target.value.address === caller.address) return err('cannot send to self')
     // Telegram sender policy — RESOLVED channel (the only-live-session fallback can
@@ -1321,7 +1334,7 @@ export async function routeSend(
     // peer.cwd enables the Ф-B transcript-mtime liveness probe (busy-session case).
     // deliverWarm is HOST-AWARE (spawn-flip Ф0b-2): a supervisor-hosted target delivers over its
     // socket, any other target keeps the tmux path. Flag-off → byte-identical to deliverViaTmux.
-    const delivered = await deliverWarm(target.value, envelope, peer.cwd)
+    const delivered = await deliverWarm(target.value, envelope, peer.cwd, {}, env)
     if (!delivered.ok) return delivered
     noteTopic(deps, target.value.address, topic)
     noteDelivered(deps, target.value.address) // В7 — floor the idle proxy so this delivery isn't reaped away
@@ -1349,12 +1362,12 @@ export async function routeSend(
     const reviveDeadline = monotonicMs() + launchdReviveGraceMs()
     while (monotonicMs() < reviveDeadline) {
       await sleep(LAUNCHD_REVIVE_POLL_MS)
-      const revived = resolvePeerDeliveryTarget(personality, runtime, peer)
+      const revived = resolvePeerDeliveryTarget(personality, runtime, peer, env)
       if (!revived.ok) continue // not back yet — keep polling until the deadline
       if (revived.value.address === caller.address) return err('cannot send to self')
       const reviveGuard = telegramSenderGuard(caller, revived.value.runtime, personality)
       if (!reviveGuard.ok) return reviveGuard
-      const delivered = await deliverWarm(revived.value, envelope, peer.cwd)
+      const delivered = await deliverWarm(revived.value, envelope, peer.cwd, {}, env)
       if (delivered.ok) {
         noteTopic(deps, revived.value.address, topic)
         return ok({
@@ -1399,7 +1412,7 @@ export async function routeSend(
   if (woke.taskDelivered === false) {
     const queued = await deps.composerQueue?.tryEnqueue({ caller, peer, target: live.value, envelope, topic })
     if (queued) return queued
-    const delivered = await deliverWarm(live.value, envelope, peer.cwd)
+    const delivered = await deliverWarm(live.value, envelope, peer.cwd, {}, env)
     if (!delivered.ok) return delivered
     noteTopic(deps, live.value.address, topic)
     return ok({