@agfpd/iapeer 0.4.47 → 0.4.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.47",
+  "version": "0.4.50",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/init/index.ts

@@ -216,7 +216,34 @@ export function codexConfigPath(options: StorageOptions = {}): string {
  *     serves every codex peer with its own identity (env_http_headers, verified live).
  * Returns {path, added} (added=false when the block already existed).
  */
-export function writeCodexMcpConfig(daemonUrl: string, options: StorageOptions = {}): { path: string; added: boolean } {
+/**
+ * Rewrite the `url = …` line INSIDE the `[mcp_servers.iapeer]` section to `url`, leaving
+ * the rest of the shared config byte-for-byte. The section runs from its header to the next
+ * `[…]` header (the `.env_http_headers` sub-table ends it — the url sits above that anyway).
+ * Returns the input unchanged when the url already matches (idempotent) or no url line exists.
+ */
+function healCodexMcpUrl(text: string, url: string): string {
+  const want = `url = ${JSON.stringify(url)}`
+  const lines = text.split('\n')
+  let inSection = false
+  for (let i = 0; i < lines.length; i++) {
+    const header = lines[i]!.match(/^\s*\[([^\]]+)\]\s*$/)
+    if (header) {
+      inSection = header[1] === `mcp_servers.${IAPEER_MCP_SERVER_NAME}`
+      continue
+    }
+    if (inSection && /^\s*url\s*=/.test(lines[i]!)) {
+      if (lines[i]!.trim() !== want) lines[i] = want
+      break // exactly one url line per server section
+    }
+  }
+  return lines.join('\n')
+}
+
+export function writeCodexMcpConfig(
+  daemonUrl: string,
+  options: StorageOptions = {},
+): { path: string; added: boolean; healed?: boolean } {
   const path = codexConfigPath(options)
   let existing = ''
   try {
@@ -224,7 +251,17 @@ export function writeCodexMcpConfig(daemonUrl: string, options: StorageOptions =
   } catch {
     /* no config yet → create it */
   }
-  if (/\[mcp_servers\.iapeer\]/.test(existing)) return { path, added: false } // idempotent
+  if (/\[mcp_servers\.iapeer\]/.test(existing)) {
+    // В44 — the block already exists, but the OLD code returned added:false WITHOUT checking
+    // the url. init bakes a fallback :8765 endpoint BEFORE the daemon publishes its real port;
+    // a later IAPEER_PORT change re-inits the claude side but left this codex block pinned to a
+    // now-DEAD port forever, while initPeer reported success. Heal the url in place (idempotent
+    // by content — only our section's `url=` line is touched, everything else is preserved).
+    const healed = healCodexMcpUrl(existing, daemonUrl)
+    if (healed === existing) return { path, added: false } // already correct → no write
+    writeFileAtomic(path, healed, 0o644)
+    return { path, added: false, healed: true }
+  }
   const block =
     `\n[mcp_servers.${IAPEER_MCP_SERVER_NAME}]\n` +
     `url = ${JSON.stringify(daemonUrl)}\n` +

package/src/launch/codexHooksTrust.ts

@@ -49,6 +49,7 @@ import { createHash } from 'crypto'
 import { dirname } from 'path'
 import { writeFileAtomic } from '../storage/index.ts'
 import { codexGlobalConfigPath } from './nativeMemory.ts'
+import { assertTomlSafeKey } from './tomlKey.ts'
 
 /** hooks.json event names → the snake_case labels codex keys state with
  *  (upstream `hook_event_key_label`). */
@@ -226,14 +227,6 @@ function resolveHooksSource(hooksJsonPath: string): string {
   return realpathSync(hooksJsonPath)
 }
 
-/** TOML basic strings treat `\` and `"` specially — paths carrying them would
- *  need escaping codex-side too; refuse instead of guessing. */
-function assertTomlSafeKey(key: string): void {
-  if (key.includes('"') || key.includes('\\')) {
-    throw new Error(`hooks.json path is not TOML-key-safe (contains " or \\): ${key}`)
-  }
-}
-
 /**
  * Pre-seed the codex hooks trust state for every command hook in the given
  * hooks.json — the deterministic, headless replacement for the "Hooks need

package/src/launch/nativeMemory.ts

@@ -21,10 +21,11 @@
 // (slot-gated, see provision/index.ts).
 
 import { existsSync, mkdirSync, readFileSync, realpathSync } from 'fs'
-import { dirname, join } from 'path'
+import { basename, dirname, join, resolve } from 'path'
 import { homedir } from 'os'
 import type { Runtime } from '../core/constants.ts'
 import { writeFileAtomic } from '../storage/index.ts'
+import { assertTomlSafeKey } from './tomlKey.ts'
 
 export type NativeMemoryState = 'off' | 'on'
 
@@ -161,6 +162,11 @@ export function preTrustCodexCwd(cwd: string, env: NodeJS.ProcessEnv = process.e
     } catch {
       /* cwd not on disk yet → keep as given */
     }
+    // В42 — the cwd becomes a QUOTED TOML key `[projects."<real>"]`. An operator-supplied
+    // `create --path` cwd carrying `"`/`\` (legal on APFS) would corrupt the SHARED global
+    // config and break codex for every peer on the host. Refuse (the try/catch reports it
+    // as a 'failed' lever); same guard the sibling hooks-trust writer uses.
+    assertTomlSafeKey(real)
     const text = existsSync(path) ? readFileSync(path, 'utf8') : ''
     if (text.includes(`[projects."${real}"]`)) return { runtime: 'codex', path, state: 'already' }
     const block = `${text.length && !text.endsWith('\n') ? '\n' : ''}${text.trim().length ? '\n' : ''}[projects."${real}"]\ntrust_level = "trusted"\n`
@@ -172,6 +178,30 @@ export function preTrustCodexCwd(cwd: string, env: NodeJS.ProcessEnv = process.e
   }
 }
 
+/**
+ * Resolve `p` to its real path even when the leaf (or several trailing components) no
+ * longer exists: realpath the nearest EXISTING ancestor and re-append the missing tail.
+ * Returns null only if nothing on the chain up to the root exists (impossible for `/`).
+ * Used by removeCodexCwdTrust to reconstruct the realpath-form key of an already-deleted
+ * cwd so a stale trust entry written under a symlink-resolved path is still matched.
+ */
+function realpathViaExistingAncestor(p: string): string | null {
+  let cur = resolve(p)
+  const tail: string[] = []
+  // Guard against an unbounded loop: dirname('/') === '/'.
+  for (let depth = 0; depth < 4096; depth++) {
+    try {
+      return tail.length ? join(realpathSync(cur), ...tail.slice().reverse()) : realpathSync(cur)
+    } catch {
+      const parent = dirname(cur)
+      if (parent === cur) return null // reached the root and even it did not resolve
+      tail.push(basename(cur))
+      cur = parent
+    }
+  }
+  return null
+}
+
 /**
  * Remove a peer's pre-trust entry from the codex GLOBAL config — the reap-side
  * counterpart of preTrustCodexCwd (backlog «remove не чистит pre-trust», made
@@ -192,7 +222,14 @@ export function removeCodexCwdTrust(cwd: string, env: NodeJS.ProcessEnv = proces
     } catch {
       /* cwd already deleted → only the literal form can match */
     }
-    const candidates = new Set([real, cwd])
+    // В43 — the writer keyed the entry on the RESOLVED real path. When the cwd is already
+    // DELETED (the throwaway-sandbox reap case), realpathSync(cwd) above throws and `real`
+    // falls back to the LITERAL cwd — which MISSES if any path component was a symlink
+    // (e.g. codex stored /private/tmp/… for a /tmp/… cwd). Reconstruct the resolved form
+    // from the nearest still-existing ANCESTOR + the deleted remainder, so the stale entry
+    // is found and removed instead of lingering as a phantom trust for that path.
+    const viaAncestor = realpathViaExistingAncestor(cwd)
+    const candidates = new Set([real, cwd, ...(viaAncestor ? [viaAncestor] : [])])
     const lines = readFileSync(path, 'utf8').split('\n')
     const kept: string[] = []
     let inDoomed = false

package/src/launch/tomlKey.ts

@@ -0,0 +1,17 @@
+// Shared TOML-key safety for the codex GLOBAL config.toml writers. codex's host-wide
+// config addresses per-project state by a QUOTED-string key — `[projects."<path>"]`,
+// `[hooks_trust."<source>"]`, `[mcp_servers.<name>]`. A TOML basic string treats `"`
+// and `\` specially, so a key carrying either would need codex-side escaping we cannot
+// guarantee round-trips; writing it raw corrupts the whole SHARED config and breaks
+// codex for EVERY peer on the host. Refuse instead of guessing.
+//
+// Extracted from codexHooksTrust.ts (which introduced it for hooks sources) so the
+// native-memory pre-trust writer reuses the exact same guard — one definition, one
+// behavior, no drift.
+
+/** Throw if `key` cannot be a raw TOML basic-string key (contains `"` or `\`). */
+export function assertTomlSafeKey(key: string): void {
+  if (key.includes('"') || key.includes('\\')) {
+    throw new Error(`path is not TOML-key-safe (contains " or \\): ${key}`)
+  }
+}

package/src/supervisor/client.ts

@@ -4,7 +4,7 @@
 // via writeSync which works inside a signal handler), and #2 backpressure is the daemon's side.
 import { writeSync } from 'node:fs'
 import { FRAME_DATA, FRAME_RESIZE, TERM_RESET, frame, makeFramer, sizePayload } from './protocol.ts'
-import { pidStartToken, readPidFile, sockPath } from './paths.ts'
+import { ownershipVerdict, pidStartToken, readPidFile, sockPath } from './paths.ts'
 
 const DETACH = 0x1d // Ctrl-]
 
@@ -32,8 +32,11 @@ export function sessionAlive(runDir: string, session: string): boolean {
   const now = Date.now()
   const cached = ownerCache.get(key)
   if (cached && cached.pid === rec.pid && cached.token === rec.token && now < cached.until) return cached.verdict
+  // Fail-SAFE on a token-READ failure (split-brain live incident 03.07): a transient `ps` spawn error
+  // returns null; treating that as "dead" let one hiccup reap a LIVE session and spawn a duplicate per
+  // message. kill-0 above already proved the pid live — only a PROVEN mismatch (a reused pid) reads dead.
   const live = pidStartToken(rec.pid)
-  const verdict = live !== null && live === rec.token // same process instance, not a reused pid
+  const verdict = ownershipVerdict(live, rec.token) // same process instance unless proven otherwise
   ownerCache.set(key, { pid: rec.pid, token: rec.token, verdict, until: now + OWNER_TTL_MS })
   return verdict
 }

package/src/supervisor/index.ts

@@ -8,7 +8,7 @@ import { spawn as nodeSpawn } from 'node:child_process'
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { runSupervisorClient, sessionAlive } from './client.ts'
-import { defaultRunDir, logPath, pidPath, pidStartToken, readPidFile, servePath, sockPath } from './paths.ts'
+import { defaultRunDir, logPath, ownershipVerdict, pidPath, pidStartToken, readPidFile, servePath, sockPath } from './paths.ts'
 
 // daemon.ts loads @xterm. It is dynamic-imported ONLY in the 'daemon' CLI case below (the detached
 // daemon process, where @xterm belongs), so importing THIS module — e.g. launch resolving
@@ -66,6 +66,46 @@ export interface StartDaemonResult {
   detail?: string
 }
 
+/** Does a unix socket at `path` ACCEPT connections right now? A dead leftover sock file refuses
+ *  instantly (ECONNREFUSED → false); the timeout only bounds a pathologically wedged listener. */
+async function sockAccepts(path: string, timeoutMs = 400): Promise<boolean> {
+  return await new Promise<boolean>(resolve => {
+    let done = false
+    const finish = (v: boolean): void => {
+      if (done) return
+      done = true
+      clearTimeout(timer)
+      resolve(v)
+    }
+    const timer = setTimeout(() => finish(false), timeoutMs)
+    Bun.connect({
+      unix: path,
+      socket: {
+        open(s) {
+          // finish BEFORE end(): under Bun, end() re-enters close() SYNCHRONOUSLY, and a
+          // close()-first would read an accepting listener as dead (verified by probe).
+          finish(true)
+          try {
+            s.end()
+          } catch {
+            /* probe only */
+          }
+        },
+        data() {},
+        close() {
+          finish(false) // closed before open fired → not accepting
+        },
+        error() {
+          finish(false)
+        },
+        connectError() {
+          finish(false) // dead leftover sock file → connect refused
+        },
+      },
+    }).catch(() => finish(false))
+  })
+}
+
 /**
  * Re-invoke THIS module as the detached daemon (spawn-flip Ф1 serving-wiring). From SOURCE (bun) the
  * module is a real file on disk → run it directly (`bun <self> daemon …` → import.meta.main →
@@ -93,6 +133,15 @@ export async function startSupervisorDaemon(opts: StartDaemonOptions): Promise<S
   const { session, runtime, runDir } = opts
   if (sessionAlive(runDir, session)) return { state: 'already-running' }
   mkdirSync(runDir, { recursive: true })
+  // Second-instance guard (В28-class, peer-session form — split-brain live incident 03.07): NEVER unlink
+  // a sock that still ACCEPTS connections. sessionAlive above keys on the pidfile, which a transient
+  // token-read failure or a clobbered pidfile can falsify — but a live supervisor HOLDS its unix socket
+  // open, so a successful connect is proof a session exists. Spawning here would create a duplicate
+  // session (split-brain: two agents answering as one peer) and orphan the live one by overwriting its
+  // pidfile. The probe client sends no FRAME_RESIZE, so it never counts as an attached operator (В23).
+  if (existsSync(sockPath(runDir, session)) && (await sockAccepts(sockPath(runDir, session)))) {
+    return { state: 'already-running' }
+  }
   try {
     if (existsSync(sockPath(runDir, session))) unlinkSync(sockPath(runDir, session))
   } catch {
@@ -174,9 +223,10 @@ export function killSession(runDir: string, session: string): boolean {
   // В22 — verify the pid is STILL our daemon before SIGTERM. After an abnormal death + pid reuse, a bare
   // kill here would SIGTERM the INNOCENT process that inherited the pid. Skip the kill when the start-token
   // no longer matches (a legacy tokenless pidfile keeps the old behavior — no regression during rollout).
-  if (rec.token) {
-    const live = pidStartToken(rec.pid)
-    if (live !== null && live !== rec.token) return false // reused pid — NOT our session; do not signal it
+  // Same ownershipVerdict primitive as sessionAlive: refuse ONLY on a PROVEN mismatch (null = unreadable
+  // token, still ours — kill must stay possible when `ps` hiccups, or a stuck session becomes unstoppable).
+  if (rec.token && !ownershipVerdict(pidStartToken(rec.pid), rec.token)) {
+    return false // reused pid — NOT our session; do not signal it
   }
   try {
     process.kill(rec.pid, 'SIGTERM')

package/src/supervisor/paths.ts

@@ -24,11 +24,22 @@ export const pidPath = (runDir: string, session: string): string => join(runDir,
 
 /** The OS-reported start time of `pid` (a stable per-process-instance token), or null if it is not
  *  running / unreadable. `ps -o lstart=` is a single spawn — callers bound its frequency (see the
- *  liveness cache in client.ts). */
+ *  liveness cache in client.ts).
+ *
+ *  LC_ALL=C is PINNED (split-brain live incident 03.07): `lstart` output is LOCALE-DEPENDENT, and the
+ *  token is compared as a STRING between processes with different env — the writer (a supervisor
+ *  inheriting the spawning terminal's locale, e.g. an operator's ru_RU `iapeer attach`) rendered
+ *  «пятница, 3 июля …» while the verifying daemon (launchd env, C locale) rendered "Fri Jul  3 …"
+ *  for the SAME start time → a PROVEN-looking mismatch → the live session read as a reused pid,
+ *  got reaped, and the next message spawned a duplicate. Pinning the locale on BOTH the write and
+ *  the verify path makes the token format process-env-independent. */
 export function pidStartToken(pid: number): string | null {
   if (!Number.isInteger(pid) || pid <= 0) return null
   try {
-    const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8' })
+    const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
+      encoding: 'utf8',
+      env: { ...process.env, LC_ALL: 'C' },
+    })
     const t = (r.stdout ?? '').trim()
     return t.length > 0 ? t : null
   } catch {
@@ -36,6 +47,20 @@ export function pidStartToken(pid: number): string | null {
   }
 }
 
+/**
+ * Ownership verdict from a live-read token vs the recorded one — the ONE semantics both liveness
+ * (`sessionAlive`) and kill (`killSession`) key on: the pid is ours unless a PROVEN mismatch.
+ * `live === null` means the token could not be READ (a transient `ps` spawn failure — EAGAIN under a
+ * post-reboot fork-storm, live incident 03.07: split-brain boris), NOT that the pid was reused; kill-0
+ * has already proven a live pid, so an unverifiable token must stay fail-SAFE (alive / still ours).
+ * Before this primitive, sessionAlive required `live !== null && live === token` (fail-open: a tool
+ * hiccup read a LIVE supervisor as dead → every wake spawned a duplicate session and orphaned the
+ * previous one by overwriting the pidfile), while killSession already treated null as "ours".
+ */
+export function ownershipVerdict(live: string | null, recorded: string): boolean {
+  return live === null ? true : live === recorded
+}
+
 /** Write the pidfile as `<pid> <startToken>` (В22). Falls back to bare `<pid>` if the token is
  *  unavailable — a tokenless pidfile is treated as legacy (owner-check skipped, kill-0 only). */
 export function writePidFile(runDir: string, session: string, pid: number): void {