@agfpd/iapeer 0.4.46 → 0.4.48

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.46",
+  "version": "0.4.48",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/init/index.ts

@@ -130,7 +130,7 @@ export function writeClaudeMcpConfig(cwd: string, personality: string, daemonUrl
  *     peer has no one to approve it, so the wake stalls. This flag pre-approves the cwd's MCP
  *     servers so the dialog never appears (verified live, claude 2.1.183). Set unconditionally.
  *   - `"tui": "default"` — pins the CLASSIC renderer so claude never pops its one-time
- *     "Try the new fullscreen renderer?" upsell modal (a BLOCKING mid-session nag that froze
+ *     "Try the new fullscreen-renderer?" upsell modal (a BLOCKING mid-session nag that froze
  *     live fleet peers; empirically an explicit tui choice suppresses it — verified live). This
  *     is the PREVENTION belt to the supervisor nag-watcher: init keeps the modal from appearing
  *     for a new peer at all, the watcher dismisses the class on every peer mid-session. Set ONLY
@@ -216,7 +216,34 @@ export function codexConfigPath(options: StorageOptions = {}): string {
  *     serves every codex peer with its own identity (env_http_headers, verified live).
  * Returns {path, added} (added=false when the block already existed).
  */
-export function writeCodexMcpConfig(daemonUrl: string, options: StorageOptions = {}): { path: string; added: boolean } {
+/**
+ * Rewrite the `url = …` line INSIDE the `[mcp_servers.iapeer]` section to `url`, leaving
+ * the rest of the shared config byte-for-byte. The section runs from its header to the next
+ * `[…]` header (the `.env_http_headers` sub-table ends it — the url sits above that anyway).
+ * Returns the input unchanged when the url already matches (idempotent) or no url line exists.
+ */
+function healCodexMcpUrl(text: string, url: string): string {
+  const want = `url = ${JSON.stringify(url)}`
+  const lines = text.split('\n')
+  let inSection = false
+  for (let i = 0; i < lines.length; i++) {
+    const header = lines[i]!.match(/^\s*\[([^\]]+)\]\s*$/)
+    if (header) {
+      inSection = header[1] === `mcp_servers.${IAPEER_MCP_SERVER_NAME}`
+      continue
+    }
+    if (inSection && /^\s*url\s*=/.test(lines[i]!)) {
+      if (lines[i]!.trim() !== want) lines[i] = want
+      break // exactly one url line per server section
+    }
+  }
+  return lines.join('\n')
+}
+
+export function writeCodexMcpConfig(
+  daemonUrl: string,
+  options: StorageOptions = {},
+): { path: string; added: boolean; healed?: boolean } {
   const path = codexConfigPath(options)
   let existing = ''
   try {
@@ -224,7 +251,17 @@ export function writeCodexMcpConfig(daemonUrl: string, options: StorageOptions =
   } catch {
     /* no config yet → create it */
   }
-  if (/\[mcp_servers\.iapeer\]/.test(existing)) return { path, added: false } // idempotent
+  if (/\[mcp_servers\.iapeer\]/.test(existing)) {
+    // В44 — the block already exists, but the OLD code returned added:false WITHOUT checking
+    // the url. init bakes a fallback :8765 endpoint BEFORE the daemon publishes its real port;
+    // a later IAPEER_PORT change re-inits the claude side but left this codex block pinned to a
+    // now-DEAD port forever, while initPeer reported success. Heal the url in place (idempotent
+    // by content — only our section's `url=` line is touched, everything else is preserved).
+    const healed = healCodexMcpUrl(existing, daemonUrl)
+    if (healed === existing) return { path, added: false } // already correct → no write
+    writeFileAtomic(path, healed, 0o644)
+    return { path, added: false, healed: true }
+  }
   const block =
     `\n[mcp_servers.${IAPEER_MCP_SERVER_NAME}]\n` +
     `url = ${JSON.stringify(daemonUrl)}\n` +

package/src/launch/codexHooksTrust.ts

@@ -49,6 +49,7 @@ import { createHash } from 'crypto'
 import { dirname } from 'path'
 import { writeFileAtomic } from '../storage/index.ts'
 import { codexGlobalConfigPath } from './nativeMemory.ts'
+import { assertTomlSafeKey } from './tomlKey.ts'
 
 /** hooks.json event names → the snake_case labels codex keys state with
  *  (upstream `hook_event_key_label`). */
@@ -226,14 +227,6 @@ function resolveHooksSource(hooksJsonPath: string): string {
   return realpathSync(hooksJsonPath)
 }
 
-/** TOML basic strings treat `\` and `"` specially — paths carrying them would
- *  need escaping codex-side too; refuse instead of guessing. */
-function assertTomlSafeKey(key: string): void {
-  if (key.includes('"') || key.includes('\\')) {
-    throw new Error(`hooks.json path is not TOML-key-safe (contains " or \\): ${key}`)
-  }
-}
-
 /**
  * Pre-seed the codex hooks trust state for every command hook in the given
  * hooks.json — the deterministic, headless replacement for the "Hooks need

package/src/launch/invocation.ts

@@ -67,5 +67,17 @@ export function buildLaunchInvocation(
   for (const k of Object.keys(childEnv)) {
     if (k.startsWith('CLAUDE_CODE_') || k === 'CLAUDECODE') delete childEnv[k]
   }
+  // В59 — pin claude to the CLASSIC (main-screen) renderer. Two load-bearing effects: (1) the whole
+  // supervisor model — pane-log serialize-snapshot, composer-occupancy, the ready-gate flip — assumes
+  // claude's DEFAULT no-alt-screen relative-cursor rendering (the daemon census). Pinning it makes that
+  // assumption UNCONDITIONAL: no future claude feature, and no mis-accepted mid-session upsell, can
+  // silently switch to the alt-screen renderer and corrupt the surface the supervisor reads off. This
+  // NEUTRALIZES the consequence of the В40 fullscreen-renderer nag even if a stray keystroke accepts it.
+  // (2) It disables the very feature that upsell offers, so the modal has nothing to enable — expected to
+  // suppress it at the SOURCE (the root-cause complement to the nag-watcher backstop). Set AFTER the
+  // CLAUDE_CODE_* strip above (which would otherwise delete it); claude-only — codex/router runtimes
+  // ignore CLAUDE_CODE_*. Safe by construction: claude already renders classic by default (peers boot and
+  // attach today), so this pins the current behavior, it does not change it.
+  if (spec.runtime === 'claude') childEnv.CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN = '1'
   return { argv, env: childEnv }
 }

package/src/launch/nativeMemory.ts

@@ -21,10 +21,11 @@
 // (slot-gated, see provision/index.ts).
 
 import { existsSync, mkdirSync, readFileSync, realpathSync } from 'fs'
-import { dirname, join } from 'path'
+import { basename, dirname, join, resolve } from 'path'
 import { homedir } from 'os'
 import type { Runtime } from '../core/constants.ts'
 import { writeFileAtomic } from '../storage/index.ts'
+import { assertTomlSafeKey } from './tomlKey.ts'
 
 export type NativeMemoryState = 'off' | 'on'
 
@@ -161,6 +162,11 @@ export function preTrustCodexCwd(cwd: string, env: NodeJS.ProcessEnv = process.e
     } catch {
       /* cwd not on disk yet → keep as given */
     }
+    // В42 — the cwd becomes a QUOTED TOML key `[projects."<real>"]`. An operator-supplied
+    // `create --path` cwd carrying `"`/`\` (legal on APFS) would corrupt the SHARED global
+    // config and break codex for every peer on the host. Refuse (the try/catch reports it
+    // as a 'failed' lever); same guard the sibling hooks-trust writer uses.
+    assertTomlSafeKey(real)
     const text = existsSync(path) ? readFileSync(path, 'utf8') : ''
     if (text.includes(`[projects."${real}"]`)) return { runtime: 'codex', path, state: 'already' }
     const block = `${text.length && !text.endsWith('\n') ? '\n' : ''}${text.trim().length ? '\n' : ''}[projects."${real}"]\ntrust_level = "trusted"\n`
@@ -172,6 +178,30 @@ export function preTrustCodexCwd(cwd: string, env: NodeJS.ProcessEnv = process.e
   }
 }
 
+/**
+ * Resolve `p` to its real path even when the leaf (or several trailing components) no
+ * longer exists: realpath the nearest EXISTING ancestor and re-append the missing tail.
+ * Returns null only if nothing on the chain up to the root exists (impossible for `/`).
+ * Used by removeCodexCwdTrust to reconstruct the realpath-form key of an already-deleted
+ * cwd so a stale trust entry written under a symlink-resolved path is still matched.
+ */
+function realpathViaExistingAncestor(p: string): string | null {
+  let cur = resolve(p)
+  const tail: string[] = []
+  // Guard against an unbounded loop: dirname('/') === '/'.
+  for (let depth = 0; depth < 4096; depth++) {
+    try {
+      return tail.length ? join(realpathSync(cur), ...tail.slice().reverse()) : realpathSync(cur)
+    } catch {
+      const parent = dirname(cur)
+      if (parent === cur) return null // reached the root and even it did not resolve
+      tail.push(basename(cur))
+      cur = parent
+    }
+  }
+  return null
+}
+
 /**
  * Remove a peer's pre-trust entry from the codex GLOBAL config — the reap-side
  * counterpart of preTrustCodexCwd (backlog «remove не чистит pre-trust», made
@@ -192,7 +222,14 @@ export function removeCodexCwdTrust(cwd: string, env: NodeJS.ProcessEnv = proces
     } catch {
       /* cwd already deleted → only the literal form can match */
     }
-    const candidates = new Set([real, cwd])
+    // В43 — the writer keyed the entry on the RESOLVED real path. When the cwd is already
+    // DELETED (the throwaway-sandbox reap case), realpathSync(cwd) above throws and `real`
+    // falls back to the LITERAL cwd — which MISSES if any path component was a symlink
+    // (e.g. codex stored /private/tmp/… for a /tmp/… cwd). Reconstruct the resolved form
+    // from the nearest still-existing ANCESTOR + the deleted remainder, so the stale entry
+    // is found and removed instead of lingering as a phantom trust for that path.
+    const viaAncestor = realpathViaExistingAncestor(cwd)
+    const candidates = new Set([real, cwd, ...(viaAncestor ? [viaAncestor] : [])])
     const lines = readFileSync(path, 'utf8').split('\n')
     const kept: string[] = []
     let inDoomed = false

package/src/launch/tomlKey.ts

@@ -0,0 +1,17 @@
+// Shared TOML-key safety for the codex GLOBAL config.toml writers. codex's host-wide
+// config addresses per-project state by a QUOTED-string key — `[projects."<path>"]`,
+// `[hooks_trust."<source>"]`, `[mcp_servers.<name>]`. A TOML basic string treats `"`
+// and `\` specially, so a key carrying either would need codex-side escaping we cannot
+// guarantee round-trips; writing it raw corrupts the whole SHARED config and breaks
+// codex for EVERY peer on the host. Refuse instead of guessing.
+//
+// Extracted from codexHooksTrust.ts (which introduced it for hooks sources) so the
+// native-memory pre-trust writer reuses the exact same guard — one definition, one
+// behavior, no drift.
+
+/** Throw if `key` cannot be a raw TOML basic-string key (contains `"` or `\`). */
+export function assertTomlSafeKey(key: string): void {
+  if (key.includes('"') || key.includes('\\')) {
+    throw new Error(`path is not TOML-key-safe (contains " or \\): ${key}`)
+  }
+}

package/src/launch/types.ts

@@ -288,7 +288,7 @@ export interface RuntimeAdapter {
   /**
    * MID-SESSION nag/upsell auto-dismiss (livability). Distinct from bootDialogKeys:
    * the boot-driver stops at ready, but claude/codex can pop a ONE-TIME interactive
-   * upsell modal AFTER the session is live (e.g. "Try the new fullscreen renderer?")
+   * upsell modal AFTER the session is live (e.g. "Try the new fullscreen-renderer?")
    * that BLOCKS the pty waiting for a keypress no headless peer answers — it froze the
    * live fleet until a human cleared it. A persistent supervisor watcher (daemon.ts)
    * runs THIS off the authoritative model for the whole session and writes the keys.

package/src/supervisor/boot.ts

@@ -44,7 +44,7 @@ export type NagAction = { kind: 'dismiss'; keys: string[]; bytes: Buffer } | { k
 /**
  * MID-SESSION nag/upsell step (livability) — the persistent sibling of nextBootAction. Unlike the
  * boot-driver, which STOPS at ready, the daemon loops this for the WHOLE session: a one-time CC upsell
- * modal (e.g. "Try the new fullscreen renderer?") can pop AFTER the session is live and BLOCK the pty on
+ * modal (e.g. "Try the new fullscreen-renderer?") can pop AFTER the session is live and BLOCK the pty on
  * a keypress no headless peer answers. If the adapter recognizes the (FULL-signature) modal it returns
  * the verified-safe DECLINE keys; the caller writes `action.bytes` to the pty (cooldown-guarded so a
  * cleared modal is never double-answered). An adapter with no nagDismissKeys → always 'none'.

package/src/supervisor/daemon.ts

@@ -599,7 +599,7 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
 
   // ── mid-session nag-watcher (livability) ────────────────────────────────────────
   // The boot-driver above STOPS at ready. But claude/codex can pop a ONE-TIME upsell modal
-  // MID-SESSION (e.g. "Try the new fullscreen renderer?", which appears on the return-to-prompt
+  // MID-SESSION (e.g. "Try the new fullscreen-renderer?", which appears on the return-to-prompt
   // boundary after a tool result) that BLOCKS the pty on a keypress no headless peer answers — it
   // froze live fleet peers (boris, doc) until a human cleared it by hand. A PERSISTENT watcher answers
   // the curated, verified-safe DECLINE for that class off the SAME authoritative @xterm model, for the