@agfpd/iapeer 0.4.48 → 0.4.51

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.48",
+  "version": "0.4.51",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/supervisor/client.ts

@@ -4,7 +4,7 @@
 // via writeSync which works inside a signal handler), and #2 backpressure is the daemon's side.
 import { writeSync } from 'node:fs'
 import { FRAME_DATA, FRAME_RESIZE, TERM_RESET, frame, makeFramer, sizePayload } from './protocol.ts'
-import { pidStartToken, readPidFile, sockPath } from './paths.ts'
+import { ownershipVerdict, pidStartToken, readPidFile, sockPath } from './paths.ts'
 
 const DETACH = 0x1d // Ctrl-]
 
@@ -32,8 +32,11 @@ export function sessionAlive(runDir: string, session: string): boolean {
   const now = Date.now()
   const cached = ownerCache.get(key)
   if (cached && cached.pid === rec.pid && cached.token === rec.token && now < cached.until) return cached.verdict
+  // Fail-SAFE on a token-READ failure (split-brain live incident 03.07): a transient `ps` spawn error
+  // returns null; treating that as "dead" let one hiccup reap a LIVE session and spawn a duplicate per
+  // message. kill-0 above already proved the pid live — only a PROVEN mismatch (a reused pid) reads dead.
   const live = pidStartToken(rec.pid)
-  const verdict = live !== null && live === rec.token // same process instance, not a reused pid
+  const verdict = ownershipVerdict(live, rec.token) // same process instance unless proven otherwise
   ownerCache.set(key, { pid: rec.pid, token: rec.token, verdict, until: now + OWNER_TTL_MS })
   return verdict
 }

package/src/supervisor/index.ts

@@ -8,7 +8,7 @@ import { spawn as nodeSpawn } from 'node:child_process'
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { runSupervisorClient, sessionAlive } from './client.ts'
-import { defaultRunDir, logPath, pidPath, pidStartToken, readPidFile, servePath, sockPath } from './paths.ts'
+import { defaultRunDir, logPath, ownershipVerdict, pidPath, pidStartToken, readPidFile, servePath, sockPath } from './paths.ts'
 
 // daemon.ts loads @xterm. It is dynamic-imported ONLY in the 'daemon' CLI case below (the detached
 // daemon process, where @xterm belongs), so importing THIS module — e.g. launch resolving
@@ -66,6 +66,46 @@ export interface StartDaemonResult {
   detail?: string
 }
 
+/** Does a unix socket at `path` ACCEPT connections right now? A dead leftover sock file refuses
+ *  instantly (ECONNREFUSED → false); the timeout only bounds a pathologically wedged listener. */
+async function sockAccepts(path: string, timeoutMs = 400): Promise<boolean> {
+  return await new Promise<boolean>(resolve => {
+    let done = false
+    const finish = (v: boolean): void => {
+      if (done) return
+      done = true
+      clearTimeout(timer)
+      resolve(v)
+    }
+    const timer = setTimeout(() => finish(false), timeoutMs)
+    Bun.connect({
+      unix: path,
+      socket: {
+        open(s) {
+          // finish BEFORE end(): under Bun, end() re-enters close() SYNCHRONOUSLY, and a
+          // close()-first would read an accepting listener as dead (verified by probe).
+          finish(true)
+          try {
+            s.end()
+          } catch {
+            /* probe only */
+          }
+        },
+        data() {},
+        close() {
+          finish(false) // closed before open fired → not accepting
+        },
+        error() {
+          finish(false)
+        },
+        connectError() {
+          finish(false) // dead leftover sock file → connect refused
+        },
+      },
+    }).catch(() => finish(false))
+  })
+}
+
 /**
  * Re-invoke THIS module as the detached daemon (spawn-flip Ф1 serving-wiring). From SOURCE (bun) the
  * module is a real file on disk → run it directly (`bun <self> daemon …` → import.meta.main →
@@ -93,6 +133,15 @@ export async function startSupervisorDaemon(opts: StartDaemonOptions): Promise<S
   const { session, runtime, runDir } = opts
   if (sessionAlive(runDir, session)) return { state: 'already-running' }
   mkdirSync(runDir, { recursive: true })
+  // Second-instance guard (В28-class, peer-session form — split-brain live incident 03.07): NEVER unlink
+  // a sock that still ACCEPTS connections. sessionAlive above keys on the pidfile, which a transient
+  // token-read failure or a clobbered pidfile can falsify — but a live supervisor HOLDS its unix socket
+  // open, so a successful connect is proof a session exists. Spawning here would create a duplicate
+  // session (split-brain: two agents answering as one peer) and orphan the live one by overwriting its
+  // pidfile. The probe client sends no FRAME_RESIZE, so it never counts as an attached operator (В23).
+  if (existsSync(sockPath(runDir, session)) && (await sockAccepts(sockPath(runDir, session)))) {
+    return { state: 'already-running' }
+  }
   try {
     if (existsSync(sockPath(runDir, session))) unlinkSync(sockPath(runDir, session))
   } catch {
@@ -174,9 +223,10 @@ export function killSession(runDir: string, session: string): boolean {
   // В22 — verify the pid is STILL our daemon before SIGTERM. After an abnormal death + pid reuse, a bare
   // kill here would SIGTERM the INNOCENT process that inherited the pid. Skip the kill when the start-token
   // no longer matches (a legacy tokenless pidfile keeps the old behavior — no regression during rollout).
-  if (rec.token) {
-    const live = pidStartToken(rec.pid)
-    if (live !== null && live !== rec.token) return false // reused pid — NOT our session; do not signal it
+  // Same ownershipVerdict primitive as sessionAlive: refuse ONLY on a PROVEN mismatch (null = unreadable
+  // token, still ours — kill must stay possible when `ps` hiccups, or a stuck session becomes unstoppable).
+  if (rec.token && !ownershipVerdict(pidStartToken(rec.pid), rec.token)) {
+    return false // reused pid — NOT our session; do not signal it
   }
   try {
     process.kill(rec.pid, 'SIGTERM')

package/src/supervisor/paths.ts

@@ -24,11 +24,22 @@ export const pidPath = (runDir: string, session: string): string => join(runDir,
 
 /** The OS-reported start time of `pid` (a stable per-process-instance token), or null if it is not
  *  running / unreadable. `ps -o lstart=` is a single spawn — callers bound its frequency (see the
- *  liveness cache in client.ts). */
+ *  liveness cache in client.ts).
+ *
+ *  LC_ALL=C is PINNED (split-brain live incident 03.07): `lstart` output is LOCALE-DEPENDENT, and the
+ *  token is compared as a STRING between processes with different env — the writer (a supervisor
+ *  inheriting the spawning terminal's locale, e.g. an operator's ru_RU `iapeer attach`) rendered
+ *  «пятница, 3 июля …» while the verifying daemon (launchd env, C locale) rendered "Fri Jul  3 …"
+ *  for the SAME start time → a PROVEN-looking mismatch → the live session read as a reused pid,
+ *  got reaped, and the next message spawned a duplicate. Pinning the locale on BOTH the write and
+ *  the verify path makes the token format process-env-independent. */
 export function pidStartToken(pid: number): string | null {
   if (!Number.isInteger(pid) || pid <= 0) return null
   try {
-    const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8' })
+    const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
+      encoding: 'utf8',
+      env: { ...process.env, LC_ALL: 'C' },
+    })
     const t = (r.stdout ?? '').trim()
     return t.length > 0 ? t : null
   } catch {
@@ -36,6 +47,20 @@ export function pidStartToken(pid: number): string | null {
   }
 }
 
+/**
+ * Ownership verdict from a live-read token vs the recorded one — the ONE semantics both liveness
+ * (`sessionAlive`) and kill (`killSession`) key on: the pid is ours unless a PROVEN mismatch.
+ * `live === null` means the token could not be READ (a transient `ps` spawn failure — EAGAIN under a
+ * post-reboot fork-storm, live incident 03.07: split-brain boris), NOT that the pid was reused; kill-0
+ * has already proven a live pid, so an unverifiable token must stay fail-SAFE (alive / still ours).
+ * Before this primitive, sessionAlive required `live !== null && live === token` (fail-open: a tool
+ * hiccup read a LIVE supervisor as dead → every wake spawned a duplicate session and orphaned the
+ * previous one by overwriting the pidfile), while killSession already treated null as "ours".
+ */
+export function ownershipVerdict(live: string | null, recorded: string): boolean {
+  return live === null ? true : live === recorded
+}
+
 /** Write the pidfile as `<pid> <startToken>` (В22). Falls back to bare `<pid>` if the token is
  *  unavailable — a tokenless pidfile is treated as legacy (owner-check skipped, kill-0 only). */
 export function writePidFile(runDir: string, session: string, pid: number): void {

package/src/tui/dashboard/model.ts

@@ -125,3 +125,14 @@ export function ellipsize(s: string, width: number): string {
   const chars = [...s]
   return chars.length <= width ? s : chars.slice(0, Math.max(0, width - 1)).join('') + '…'
 }
+
+// ─── attach-child failure surfacing ─────────────────────────────────────────
+
+/** Why a spawned `iapeer attach <peer>` run needs the operator's attention, or null when it
+ *  ended fine. PURE: a spawn error AND a non-zero/signal exit both surface — a failed child
+ *  silently remounted over reads as "Enter does nothing" to the operator (live incident 03.07). */
+export function attachFailureMessage(r: { error?: Error; status: number | null }): string | null {
+  if (r.error) return r.error.message
+  if ((r.status ?? 1) !== 0) return `iapeer attach exited with ${r.status ?? 'a signal'}`
+  return null
+}

package/src/tui/dashboard/run.tsx

@@ -4,7 +4,11 @@
 //  - alt-screen: the dashboard is a full-screen live surface; it renders on the
 //    alternate screen so quitting restores the operator's scrollback untouched
 //    (Apple Terminal keeps no E3, so repeated in-scrollback repaints would pile up —
-//    the alt-screen sidesteps that class entirely).
+//    the alt-screen sidesteps that class entirely). The alt-screen is owned by INK
+//    (`alternateScreen: true`), NOT written manually: Ink's resize/erase heuristics
+//    (clear-on-width-shrink, fullscreen-frame clears) key on the buffer IT manages —
+//    a manual \x1b[?1049h behind Ink's back left it erasing by stale line-counts, so
+//    a window resize stacked old frames (live incident: the footer repeated ~5×).
 //  - интерактив только в реальном TTY (контракт фазы): stdin+stdout must both be
 //    TTYs, else the caller falls back to the scriptable table (never render + hang;
 //    the same fail-closed belt as the onboard wizard).
@@ -12,7 +16,10 @@
 //    dashboard fully unmounts + leaves the alt-screen + returns the terminal to
 //    cooked mode, then spawns `iapeer attach <peer>` as a CHILD with inherited stdio
 //    (the runtime TUI gets the REAL tty — the readline-class constraint), waits, and
-//    remounts. One full-screen TUI owns the terminal at any moment.
+//    remounts. One full-screen TUI owns the terminal at any moment. A child that
+//    FAILS (spawn error OR exit≠0) is surfaced and acknowledged — never silently
+//    remounted over (live incident: Enter looked dead because the attach child died
+//    instantly and the remount swallowed its error).
 //
 // Self-invocation uses the same `$bunfs` discriminator as supervisor's
 // resolveDaemonSelfArgv: compiled standalone → re-invoke the binary by verb; running
@@ -23,13 +30,11 @@ import { render } from 'ink'
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 import { DashboardApp, type DashAction } from './app.tsx'
+import { attachFailureMessage } from './model.ts'
 
 /** Sentinel: no real interactive TTY — the caller should print the scriptable table. */
 export const DASHBOARD_NOT_INTERACTIVE = -1
 
-const ALT_SCREEN_ON = '\x1b[?1049h\x1b[H'
-const ALT_SCREEN_OFF = '\x1b[?1049l'
-
 /** argv prefix that re-invokes THIS package's CLI (compiled binary by verb / src via
  *  bun). Same discriminator as supervisor/index.ts resolveDaemonSelfArgv: `$bunfs` in
  *  the module path marks the compiled standalone (existsSync is NO discriminator —
@@ -49,17 +54,16 @@ export interface DashboardOptions {
 /** Mount the dashboard once; resolve with the action that ended it. */
 async function mountOnce(env: NodeJS.ProcessEnv): Promise<DashAction> {
   let action: DashAction = { type: 'quit' }
-  process.stdout.write(ALT_SCREEN_ON)
-  try {
-    const app = render(<DashboardApp env={env} onAction={a => (action = a)} />, {
-      // the dashboard repaints in place on the alt screen; Ctrl-C is handled by the
-      // app itself (quit action) so a half-torn frame never leaks to the main screen
-      exitOnCtrlC: false,
-    })
-    await app.waitUntilExit()
-  } finally {
-    process.stdout.write(ALT_SCREEN_OFF)
-  }
+  const app = render(<DashboardApp env={env} onAction={a => (action = a)} />, {
+    // the dashboard repaints in place on the alt screen; Ctrl-C is handled by the
+    // app itself (quit action) so a half-torn frame never leaks to the main screen
+    exitOnCtrlC: false,
+    // Ink OWNS the alt-screen (enter on mount, exit+cursor-restore on unmount —
+    // BEFORE waitUntilExit resolves, so the attach child always gets the primary
+    // buffer). Manual 1049-writes behind Ink's back broke its resize erase model.
+    alternateScreen: true,
+  })
+  await app.waitUntilExit()
   return action
 }
 
@@ -87,8 +91,12 @@ export async function runDashboard(opts: DashboardOptions = {}): Promise<number>
       stdio: 'inherit',
       env,
     })
-    if (r.error) {
-      process.stdout.write(`attach failed: ${r.error.message}\npress Enter to continue…`)
+    // Surface BOTH failure shapes before remounting: a spawn error AND a child that ran but
+    // FAILED (exit≠0 / signal — its own stderr is already on the primary screen via inherit).
+    // Remounting silently over either reads as "Enter does nothing" (live incident).
+    const failure = attachFailureMessage(r)
+    if (failure) {
+      process.stdout.write(`attach ${action.personality} failed: ${failure}\npress Enter to continue…`)
       // swallow one line so the operator sees the error before the alt-screen returns
       spawnSync('sh', ['-c', 'read _'], { stdio: 'inherit' })
     }