@agfpd/iapeer 0.4.48 → 0.4.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.48",
+  "version": "0.4.50",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/supervisor/client.ts

@@ -4,7 +4,7 @@
 // via writeSync which works inside a signal handler), and #2 backpressure is the daemon's side.
 import { writeSync } from 'node:fs'
 import { FRAME_DATA, FRAME_RESIZE, TERM_RESET, frame, makeFramer, sizePayload } from './protocol.ts'
-import { pidStartToken, readPidFile, sockPath } from './paths.ts'
+import { ownershipVerdict, pidStartToken, readPidFile, sockPath } from './paths.ts'
 
 const DETACH = 0x1d // Ctrl-]
 
@@ -32,8 +32,11 @@ export function sessionAlive(runDir: string, session: string): boolean {
   const now = Date.now()
   const cached = ownerCache.get(key)
   if (cached && cached.pid === rec.pid && cached.token === rec.token && now < cached.until) return cached.verdict
+  // Fail-SAFE on a token-READ failure (split-brain live incident 03.07): a transient `ps` spawn error
+  // returns null; treating that as "dead" let one hiccup reap a LIVE session and spawn a duplicate per
+  // message. kill-0 above already proved the pid live — only a PROVEN mismatch (a reused pid) reads dead.
   const live = pidStartToken(rec.pid)
-  const verdict = live !== null && live === rec.token // same process instance, not a reused pid
+  const verdict = ownershipVerdict(live, rec.token) // same process instance unless proven otherwise
   ownerCache.set(key, { pid: rec.pid, token: rec.token, verdict, until: now + OWNER_TTL_MS })
   return verdict
 }

package/src/supervisor/index.ts

@@ -8,7 +8,7 @@ import { spawn as nodeSpawn } from 'node:child_process'
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { runSupervisorClient, sessionAlive } from './client.ts'
-import { defaultRunDir, logPath, pidPath, pidStartToken, readPidFile, servePath, sockPath } from './paths.ts'
+import { defaultRunDir, logPath, ownershipVerdict, pidPath, pidStartToken, readPidFile, servePath, sockPath } from './paths.ts'
 
 // daemon.ts loads @xterm. It is dynamic-imported ONLY in the 'daemon' CLI case below (the detached
 // daemon process, where @xterm belongs), so importing THIS module — e.g. launch resolving
@@ -66,6 +66,46 @@ export interface StartDaemonResult {
   detail?: string
 }
 
+/** Does a unix socket at `path` ACCEPT connections right now? A dead leftover sock file refuses
+ *  instantly (ECONNREFUSED → false); the timeout only bounds a pathologically wedged listener. */
+async function sockAccepts(path: string, timeoutMs = 400): Promise<boolean> {
+  return await new Promise<boolean>(resolve => {
+    let done = false
+    const finish = (v: boolean): void => {
+      if (done) return
+      done = true
+      clearTimeout(timer)
+      resolve(v)
+    }
+    const timer = setTimeout(() => finish(false), timeoutMs)
+    Bun.connect({
+      unix: path,
+      socket: {
+        open(s) {
+          // finish BEFORE end(): under Bun, end() re-enters close() SYNCHRONOUSLY, and a
+          // close()-first would read an accepting listener as dead (verified by probe).
+          finish(true)
+          try {
+            s.end()
+          } catch {
+            /* probe only */
+          }
+        },
+        data() {},
+        close() {
+          finish(false) // closed before open fired → not accepting
+        },
+        error() {
+          finish(false)
+        },
+        connectError() {
+          finish(false) // dead leftover sock file → connect refused
+        },
+      },
+    }).catch(() => finish(false))
+  })
+}
+
 /**
  * Re-invoke THIS module as the detached daemon (spawn-flip Ф1 serving-wiring). From SOURCE (bun) the
  * module is a real file on disk → run it directly (`bun <self> daemon …` → import.meta.main →
@@ -93,6 +133,15 @@ export async function startSupervisorDaemon(opts: StartDaemonOptions): Promise<S
   const { session, runtime, runDir } = opts
   if (sessionAlive(runDir, session)) return { state: 'already-running' }
   mkdirSync(runDir, { recursive: true })
+  // Second-instance guard (В28-class, peer-session form — split-brain live incident 03.07): NEVER unlink
+  // a sock that still ACCEPTS connections. sessionAlive above keys on the pidfile, which a transient
+  // token-read failure or a clobbered pidfile can falsify — but a live supervisor HOLDS its unix socket
+  // open, so a successful connect is proof a session exists. Spawning here would create a duplicate
+  // session (split-brain: two agents answering as one peer) and orphan the live one by overwriting its
+  // pidfile. The probe client sends no FRAME_RESIZE, so it never counts as an attached operator (В23).
+  if (existsSync(sockPath(runDir, session)) && (await sockAccepts(sockPath(runDir, session)))) {
+    return { state: 'already-running' }
+  }
   try {
     if (existsSync(sockPath(runDir, session))) unlinkSync(sockPath(runDir, session))
   } catch {
@@ -174,9 +223,10 @@ export function killSession(runDir: string, session: string): boolean {
   // В22 — verify the pid is STILL our daemon before SIGTERM. After an abnormal death + pid reuse, a bare
   // kill here would SIGTERM the INNOCENT process that inherited the pid. Skip the kill when the start-token
   // no longer matches (a legacy tokenless pidfile keeps the old behavior — no regression during rollout).
-  if (rec.token) {
-    const live = pidStartToken(rec.pid)
-    if (live !== null && live !== rec.token) return false // reused pid — NOT our session; do not signal it
+  // Same ownershipVerdict primitive as sessionAlive: refuse ONLY on a PROVEN mismatch (null = unreadable
+  // token, still ours — kill must stay possible when `ps` hiccups, or a stuck session becomes unstoppable).
+  if (rec.token && !ownershipVerdict(pidStartToken(rec.pid), rec.token)) {
+    return false // reused pid — NOT our session; do not signal it
   }
   try {
     process.kill(rec.pid, 'SIGTERM')

package/src/supervisor/paths.ts

@@ -24,11 +24,22 @@ export const pidPath = (runDir: string, session: string): string => join(runDir,
 
 /** The OS-reported start time of `pid` (a stable per-process-instance token), or null if it is not
  *  running / unreadable. `ps -o lstart=` is a single spawn — callers bound its frequency (see the
- *  liveness cache in client.ts). */
+ *  liveness cache in client.ts).
+ *
+ *  LC_ALL=C is PINNED (split-brain live incident 03.07): `lstart` output is LOCALE-DEPENDENT, and the
+ *  token is compared as a STRING between processes with different env — the writer (a supervisor
+ *  inheriting the spawning terminal's locale, e.g. an operator's ru_RU `iapeer attach`) rendered
+ *  «пятница, 3 июля …» while the verifying daemon (launchd env, C locale) rendered "Fri Jul  3 …"
+ *  for the SAME start time → a PROVEN-looking mismatch → the live session read as a reused pid,
+ *  got reaped, and the next message spawned a duplicate. Pinning the locale on BOTH the write and
+ *  the verify path makes the token format process-env-independent. */
 export function pidStartToken(pid: number): string | null {
   if (!Number.isInteger(pid) || pid <= 0) return null
   try {
-    const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8' })
+    const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
+      encoding: 'utf8',
+      env: { ...process.env, LC_ALL: 'C' },
+    })
     const t = (r.stdout ?? '').trim()
     return t.length > 0 ? t : null
   } catch {
@@ -36,6 +47,20 @@ export function pidStartToken(pid: number): string | null {
   }
 }
 
+/**
+ * Ownership verdict from a live-read token vs the recorded one — the ONE semantics both liveness
+ * (`sessionAlive`) and kill (`killSession`) key on: the pid is ours unless a PROVEN mismatch.
+ * `live === null` means the token could not be READ (a transient `ps` spawn failure — EAGAIN under a
+ * post-reboot fork-storm, live incident 03.07: split-brain boris), NOT that the pid was reused; kill-0
+ * has already proven a live pid, so an unverifiable token must stay fail-SAFE (alive / still ours).
+ * Before this primitive, sessionAlive required `live !== null && live === token` (fail-open: a tool
+ * hiccup read a LIVE supervisor as dead → every wake spawned a duplicate session and orphaned the
+ * previous one by overwriting the pidfile), while killSession already treated null as "ours".
+ */
+export function ownershipVerdict(live: string | null, recorded: string): boolean {
+  return live === null ? true : live === recorded
+}
+
 /** Write the pidfile as `<pid> <startToken>` (В22). Falls back to bare `<pid>` if the token is
  *  unavailable — a tokenless pidfile is treated as legacy (owner-check skipped, kill-0 only). */
 export function writePidFile(runDir: string, session: string, pid: number): void {