@agfpd/iapeer 0.4.51 → 0.4.53

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.51",
+  "version": "0.4.53",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -244,12 +244,21 @@ export function stopPeer(personality: string, runtime: string | undefined, opts:
     const identity = buildProcessAddress(rt, personality)
     const sock = buildSocketPath(rt, personality, cfg.sockDir)
     if (isInfraRuntime(rt)) {
-      // Audit #13: do NOT swallow the launchctl result. (bootout returns non-zero when
-      // the service was already not loaded — benign for stop — but surface the detail in
-      // the reason rather than silently claiming success.)
+      // Audit #13 + В48: do NOT swallow the launchctl result — but DISCRIMINATE. An
+      // already-unloaded job (exit 3 / "No such process", verified live) is BENIGN for
+      // stop: the desired state ("not running") already holds, so it carries NO reason
+      // and must not fail the verb. Any other non-zero is a REAL error and sets reason
+      // (the CLI maps a reasoned bootout to exit 1).
       const r = spawnSync('launchctl', ['bootout', `gui/${uid()}/${launchdLabel(personality)}`], { encoding: 'utf8' })
       killSession(sock, identity, env)
-      out.push({ personality, runtime: rt, action: 'bootout', reason: r.status === 0 ? undefined : `launchctl bootout exited ${r.status}${(r.stderr ?? '').trim() ? `: ${(r.stderr ?? '').trim()}` : ''}` })
+      const stderrText = (r.stderr ?? '').trim()
+      const benign = r.status === 0 || r.status === 3 || /No such process/i.test(stderrText)
+      out.push({
+        personality,
+        runtime: rt,
+        action: 'bootout',
+        reason: benign ? undefined : `launchctl bootout exited ${r.status}${stderrText ? `: ${stderrText}` : ''}`,
+      })
     } else {
       // A deliberate stop is a CLEAN PARK, not a death (stop→start must survive ≥
       // idle-reap): park-mark BEFORE the kill so the post-`start`
@@ -1131,6 +1140,32 @@ function parseIdentity(identity: string): { personality: string; runtime: Runtim
 // CLI dispatch — `iapeer <verb> …`
 // ─────────────────────────────────────────────────────────────────────────────
 
+/** В49 — flags that never take a value. Without the schema the look-ahead form ate the
+ *  NEXT positional: `iapeer update --force 0.4.31` parsed as flags.force='0.4.31' with NO
+ *  positionals → an UNforced full-cascade update instead of a forced version pin (live
+ *  incident shape). A boolean flag is always `true`; forcing a value onto one is only
+ *  possible via the explicit `--key=value` form (which stays verbatim). */
+const BOOLEAN_FLAGS: ReadonlySet<string> = new Set([
+  'accept-risk',
+  'all',
+  'check',
+  'dry-run',
+  'fix',
+  'force',
+  'foundation-only',
+  'install-plist',
+  'json',
+  'no-bootstrap',
+  'no-memory',
+  'no-notifier',
+  'no-setup',
+  'no-telegram',
+  'no-voice',
+  'npx',
+  'remove-codesign-identity',
+  'yes',
+])
+
 export function parseArgs(argv: string[]): { positionals: string[]; flags: Record<string, string | true> } {
   const positionals: string[] = []
   const flags: Record<string, string | true> = {}
@@ -1145,6 +1180,11 @@ export function parseArgs(argv: string[]): { positionals: string[]; flags: Recor
         continue
       }
       const key = a.slice(2)
+      // В49 — a KNOWN boolean flag never consumes the next token as its value.
+      if (BOOLEAN_FLAGS.has(key)) {
+        flags[key] = true
+        continue
+      }
       const next = argv[i + 1]
       if (next === undefined || next.startsWith('--')) flags[key] = true
       else flags[key] = argv[++i]
@@ -1684,9 +1724,13 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         out(
           `initialized "${r.personality}" (default: ${r.runtime}; runtimes: ${allRuntimes.join(', ')}); ` +
             `mcp: ${r.mcpConfigPaths.join(', ') || r.codexMcpConfigPath || 'none'}` +
-            `${r.bootstrapped ? `; bootstrap: ${r.bootstrapped.state}` : ''}\n`,
+            `${r.bootstrapped ? `; bootstrap: ${r.bootstrapped.state}` : ''}` +
+            `${r.selfConfig?.state === 'failed' ? '; self-config: FAILED (infra peer NOT started)' : ''}\n`,
         )
-        return 0
+        // В47 — a failed runtime self-config means initPeer deliberately did NOT bootstrap:
+        // the always-on peer is not running. Exit 0 here read as success to automation.
+        if (r.selfConfig?.state === 'failed') return 1
+        return r.bootstrapped && (r.bootstrapped.state === 'failed' || r.bootstrapped.state === 'refused-foreign') ? 1 : 0
       }
       case 'create': {
         // cwd-INDEPENDENT: resolve a location (default ~/.iapeer/peers/<p> or --path),
@@ -1753,8 +1797,13 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         out(
           `created "${r.personality}" (default: ${r.runtime}; runtimes: ${allRuntimes.join(', ')}) at ${r.location}; ` +
             `mcp: ${r.mcpConfigPaths.join(', ') || r.codexMcpConfigPath || 'none'}` +
-            `${r.plistPath ? `; plist: ${r.plistPath}` : ''}${r.bootstrapped ? `; bootstrap: ${r.bootstrapped.state}` : ''}\n`,
+            `${r.plistPath ? `; plist: ${r.plistPath}` : ''}${r.bootstrapped ? `; bootstrap: ${r.bootstrapped.state}` : ''}` +
+            `${r.selfConfig?.state === 'failed' ? '; self-config: FAILED (infra peer NOT started)' : ''}\n`,
         )
+        // В47 — selfConfig 'failed' deliberately skips the bootstrap (initPeer), so the
+        // always-on peer is NOT running; `create x --runtime telegram` with a broken hook
+        // exited 0 and automation read a dead telegram router as provisioned.
+        if (r.selfConfig?.state === 'failed') return 1
         return r.bootstrapped && (r.bootstrapped.state === 'failed' || r.bootstrapped.state === 'refused-foreign') ? 1 : 0
       }
       case 'list': {
@@ -1865,7 +1914,9 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         if (!peers) return argErr(errOut, 'stop needs a peer or --all — usage: iapeer stop <peer> [runtime] | --all')
         const outcomes = peers.flatMap(p => stopPeer(p, flags.all === true ? undefined : positionals[1], { env }))
         for (const o of outcomes) out(`${o.personality} (${o.runtime}): ${o.action}${o.reason ? ` — ${o.reason}` : ''}\n`)
-        return outcomes.some(o => o.action === 'refused-foreign-launchd') ? 1 : 0
+        // В48 — a REAL bootout error (reason set; benign already-unloaded carries none) is exit 1:
+        // automation must see that an always-on peer may still be running.
+        return outcomes.some(o => o.action === 'refused-foreign-launchd' || (o.action === 'bootout' && o.reason !== undefined)) ? 1 : 0
       }
       case 'add-runtime': {
         // Fleet-switch enabler (codex-parity audit): add an agentic runtime to
@@ -1917,7 +1968,9 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         if (!peers) return argErr(errOut, 'start needs a peer or --all — usage: iapeer start <peer> [runtime] | --all')
         const outcomes = peers.flatMap(p => startPeer(p, flags.all === true ? undefined : positionals[1], { env }))
         for (const o of outcomes) out(`${o.personality} (${o.runtime}): ${o.action}${o.reason ? ` — ${o.reason}` : ''}\n`)
-        return outcomes.some(o => o.action === 'refused-foreign-launchd') ? 1 : 0
+        // В48 — a failed launchctl bootstrap (reason set) means the always-on peer is NOT
+        // started; exit 0 here let automation read a dead telegram/notifier as running.
+        return outcomes.some(o => o.action === 'refused-foreign-launchd' || (o.action === 'bootstrap' && o.reason !== undefined)) ? 1 : 0
       }
       case 'refresh': {
         // LAZY soft-reload (fleet doctrine refresh): arm `.fresh-next` so each agentic peer comes up FRESH

package/src/enable/index.ts

@@ -24,7 +24,7 @@ import { spawnSync } from 'child_process'
 import { existsSync, readFileSync, realpathSync } from 'fs'
 import { basename, join } from 'path'
 import { homedir } from 'os'
-import { MARKETPLACE_NAME, isMarketplaceRegisteredAs, refreshMarketplace, registerMarketplace } from '../onboard/index.ts'
+import { MARKETPLACE_NAME, isExecutable, isMarketplaceRegisteredAs, refreshMarketplace, registerMarketplace } from '../onboard/index.ts'
 import { findPeer, readPeersIndex } from '../registry/index.ts'
 import { IapError } from '../core/errors.ts'
 import { normalizeNameCandidate } from '../core/normalize.ts'
@@ -205,10 +205,14 @@ function resolvePeer(opts: EnableOptions): { personality: string; cwd: string; r
   return { personality, cwd: rec.cwd, runtimes: agentic }
 }
 
-function isExecutable(bin: string, env: NodeJS.ProcessEnv): boolean {
-  const r = spawnSync(bin, ['--version'], { stdio: 'ignore', env: env as Record<string, string> })
-  return r.error === undefined && r.status !== null
-}
+// В57 — the local `--version` ANSWER probe was removed: it spawned the runtime CLI with NO
+// timeout, so a wedged binary (the known macOS launch-approval park after a cask update —
+// onboard's live incident: probes sat 25+ min) hung `enable` forever. enable now uses
+// onboard's PRESENCE probe (accessSync X_OK / PATH scan — no spawn at all), and every real
+// runtime-CLI invocation below carries a hard timeout, mirroring onboard.
+const LIST_TIMEOUT_MS = 60_000 // read-only queries (plugin list)
+const MUTATE_TIMEOUT_MS = 120_000 // install / enable / add (may clone from GitHub)
+const SETUP_TIMEOUT_MS = 300_000 // a СЛОЖНЫЙ plugin's own installer — the longest legitimate leg
 
 /** Read the peer-scoped entry for this plugin from a fresh `claude plugin list --json`.
  *  CRITICAL: `enabled` is evaluated relative to the CURRENT cwd's project (verified
@@ -227,6 +231,7 @@ function claudeEntry(
     encoding: 'utf8',
     env: env as Record<string, string>,
     maxBuffer: 64 * 1024 * 1024,
+    timeout: LIST_TIMEOUT_MS,
   })
   return findPeerScopedEntry(parseInstalledPlugins(list.stdout ?? ''), plugin, marketplace, peerCwd)
 }
@@ -251,6 +256,7 @@ function enableClaude(plugin: string, marketplace: string, peerCwd: string, env:
       cwd: peerCwd,
       encoding: 'utf8',
       env: env as Record<string, string>,
+      timeout: MUTATE_TIMEOUT_MS,
     })
     if (inst.status !== 0) {
       return { runtime: 'claude', state: 'failed', detail: (inst.stderr || inst.stdout || `exit ${inst.status}`).trim() }
@@ -264,6 +270,7 @@ function enableClaude(plugin: string, marketplace: string, peerCwd: string, env:
       cwd: peerCwd,
       encoding: 'utf8',
       env: env as Record<string, string>,
+      timeout: MUTATE_TIMEOUT_MS,
     })
     const confirmed = claudeEntry(bin, plugin, marketplace, peerCwd, env)
     if (!confirmed?.enabled) {
@@ -300,7 +307,12 @@ export function parseCodexPluginStatus(jsonOutput: string, id: string): 'enabled
 }
 
 function codexState(bin: string, id: string, env: NodeJS.ProcessEnv): 'enabled' | 'disabled' | 'absent' {
-  const r = spawnSync(bin, ['plugin', 'list', '--json'], { encoding: 'utf8', env: env as Record<string, string>, maxBuffer: 64 * 1024 * 1024 })
+  const r = spawnSync(bin, ['plugin', 'list', '--json'], {
+    encoding: 'utf8',
+    env: env as Record<string, string>,
+    maxBuffer: 64 * 1024 * 1024,
+    timeout: LIST_TIMEOUT_MS,
+  })
   return parseCodexPluginStatus(r.stdout ?? '', id)
 }
 
@@ -314,7 +326,11 @@ function enableCodex(plugin: string, marketplace: string, env: NodeJS.ProcessEnv
   const id = `${plugin}@${marketplace}`
   const before = codexState(bin, id, env)
   if (before === 'enabled') return { runtime: 'codex', state: 'already-enabled' }
-  const add = spawnSync(bin, ['plugin', 'add', id], { encoding: 'utf8', env: env as Record<string, string> })
+  const add = spawnSync(bin, ['plugin', 'add', id], {
+    encoding: 'utf8',
+    env: env as Record<string, string>,
+    timeout: MUTATE_TIMEOUT_MS,
+  })
   if (add.status !== 0) {
     return { runtime: 'codex', state: 'failed', detail: (add.stderr || add.stdout || `exit ${add.status}`).trim() }
   }
@@ -346,6 +362,7 @@ function callSetup(
     cwd: installPath,
     encoding: 'utf8',
     env: setupEnv as Record<string, string>,
+    timeout: SETUP_TIMEOUT_MS,
   })
   if (r.error || (r.status ?? 1) !== 0) {
     return { ok: false, detail: (r.stderr || r.stdout || r.error?.message || `exit ${r.status}`).trim() }

package/src/identity/index.ts

@@ -120,6 +120,12 @@ export interface EnsurePeerProfileOptions {
    *  always-on plist so launchd's minimal PATH resolves it. Forwarded to
    *  installAlwaysOnPlist; ignored for warm-on-demand runtimes. */
   runtimeBin?: string
+  /** В36 — peer description, persisted into the LOCAL profile (the source of truth the
+   *  registry is reindexed FROM). Writing it only to the registry made it a stale copy:
+   *  the first reindexFromLocals (addRuntime on a dual-runtime create, connect telegram,
+   *  verify --fix) projected the profile's empty description over it, wiping the Layer-3
+   *  addressing signal fleet-wide. */
+  description?: string
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -513,7 +519,9 @@ export function ensurePeerProfile(options: EnsurePeerProfileOptions): PeerProfil
       personality,
       runtime: options.runtime,
       runtimes: discoveredRuntimes,
-      description: '',
+      // В36 — the description lands in the LOCAL profile at birth (source of truth);
+      // the registry row is a projection of this file, not the other way around.
+      description: options.description?.trim() ?? '',
       intelligence: defaultIntelligenceForRuntime(options.runtime),
     }
     ensureLocalRuntimeScopes(cwd, profile.runtimes)
@@ -573,8 +581,17 @@ export function ensurePeerProfile(options: EnsurePeerProfileOptions): PeerProfil
     })
     intelligence = defaultIntelligenceForRuntime(options.runtime)
   }
-  if (mergedRuntimes.length !== existing.runtimes.length || intelligence !== existing.intelligence) {
-    const updated = { ...existing, runtimes: mergedRuntimes, intelligence }
+  // В36 — an explicit description on RE-provision updates the local profile too (H1 in
+  // writePeerProfileAtomic still guards: absent/empty never wipes an existing value).
+  const explicitDescription = options.description?.trim()
+  const descriptionChanged = Boolean(explicitDescription) && explicitDescription !== existing.description
+  if (mergedRuntimes.length !== existing.runtimes.length || intelligence !== existing.intelligence || descriptionChanged) {
+    const updated = {
+      ...existing,
+      runtimes: mergedRuntimes,
+      intelligence,
+      ...(descriptionChanged ? { description: explicitDescription! } : {}),
+    }
     writePeerProfileAtomic(cwd, updated)
     return updated
   }

package/src/launch/invocation.ts

@@ -50,7 +50,13 @@ export function buildLaunchInvocation(
     PEER_PERSONALITY: spec.personality,
     PEER_RUNTIME: spec.runtime,
     PEER_IDENTITY: spec.identity,
-    PATH: env.PATH ?? `${homedir()}/.bun/bin:${homedir()}/.local/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/bin:/bin`,
+    // В45 — a per-peer launch.env PATH override WINS: this literal sits after the launchEnv
+    // spread, so `env.PATH ?? default` silently clobbered the operator's override (env.PATH
+    // is nearly always set). The legacy launcher sourced the file — there PATH took effect.
+    PATH:
+      launchEnv.env.PATH ??
+      env.PATH ??
+      `${homedir()}/.bun/bin:${homedir()}/.local/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/bin:/bin`,
   }
   // Strip the claude-code-internal session namespace from the inherited env. When a launch is
   // INITIATED from inside a running claude session (an operator CLI, or a claude peer shelling out),

package/src/onboard/index.ts

@@ -71,7 +71,10 @@ function runtimeBin(runtime: OnboardRuntime, env: NodeJS.ProcessEnv): string {
   return env.IAPEER_CODEX_BIN?.trim() || 'codex'
 }
 
-function isExecutable(binOrName: string, env: NodeJS.ProcessEnv = process.env): boolean {
+/** PRESENCE probe (no spawn) — exported for enable/ (В57): the same wedged-runtime class
+ *  (macOS launch-approval parking every invocation pre-main) hung enable's `--version`
+ *  ANSWER probe forever; presence answers "is it installed" without executing anything. */
+export function isExecutable(binOrName: string, env: NodeJS.ProcessEnv = process.env): boolean {
   if (binOrName.includes('/')) {
     try {
       accessSync(binOrName, FS.X_OK)

package/src/provision/index.ts

@@ -89,6 +89,9 @@ export async function provisionPeer(opts: ProvisionPeerOptions): Promise<Provisi
     peers,
     personality: opts.personality,
     runtimeBin,
+    // В36 — description goes into the LOCAL profile (source of truth); the registry
+    // upsert below then persists a value reindexFromLocals can no longer wipe.
+    description: opts.description,
     warn: opts.warn,
   })
   // Birth-time native-memory lever (контракт «Слот памяти» §Native-память рантаймов):