@agfpd/iapeer 0.4.58 → 0.4.60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.58",
+  "version": "0.4.60",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/daemon/main.ts

@@ -39,6 +39,7 @@ import {
   addTopic,
   loadLifecycleConfig,
   processEagerRelaunches,
+  processOrphanEagerMarks,
   readTopic,
   resolveWakeRuntime,
   setEphemeralArmed,
@@ -373,6 +374,10 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
       tick: async () => {
         const outcomes = superviseTick(cfg, { env })
         await processEagerRelaunches(cfg, outcomes, { env })
+        // Orphaned-eager fallback: a .new-eager whose session died WITHOUT a .session
+        // on disk is invisible to superviseTick — relaunch it fresh here (H4-guarded;
+        // live incident 03.07: a self-fresh peer lay down until the owner attached).
+        await processOrphanEagerMarks(cfg, { env })
         // M3 drain scan — ONE mechanism for the whole serial-queue loop: feeds the
         // next task right after a reaped-ephemeral (same tick), drains on daemon
         // start (durable queue), and RETRIES a failed wake (the item stayed at the

package/src/launch/adapters/codex.ts

@@ -21,7 +21,11 @@
 //     Active 253-261) + the keys the boot loop sends (382-400),
 //     newestCodexSessionMtime + codexSessionCwd (200-234), and
 //     answerPermissionDialog's codex branch (302-306: Down then Enter) over
-//     dialogs.ts codexApprovalActive (39-45).
+//     dialogs.ts codexApprovalActive (39-45). NB the permission autopilot was
+//     NOT ported (no answerPermissionDialog in this codebase): the permission
+//     class is closed STRUCTURALLY instead — every peer runs
+//     --dangerously-bypass-approvals-and-sandbox (buildArgs below) and init
+//     bakes default_tools_approval_mode="approve", so the dialog never shows.
 //
 // The doctrine -c value is the bare `model_instructions_file=<f>` token: the
 // TOML value-side quotes in codex-start.sh:224 exist only because that string is

package/src/lifecycle/index.ts

@@ -622,9 +622,26 @@ export function resolveWakeMode(
   resolveResume: (cwd: string) => { ok: boolean; ref?: string; reason?: string },
   incomingTopic?: string,
 ): WakeMode {
-  // 1. folder-launch → always fresh.
-  if (argsResume === false) return { resume: false, cause: 'folder-launch' }
-  // 2. attach → always resume, fail-loud if nothing to resume.
+  // 1. folder-launch → always fresh. Consume a standing .new-eager too — the mark's
+  // promise ("next bring-up is FRESH") is fulfilled by this launch; leaving it would
+  // leak an eager relaunch into a LATER, unrelated death.
+  if (argsResume === false) {
+    clearNewEager(cfg, identity)
+    return { resume: false, cause: 'folder-launch' }
+  }
+  // 1.5 — a standing .new-eager OUTRANKS EVERYTHING below, including attach-resume
+  // (live incident 03.07: a peer self-freshed, its eager relaunch never fired — the
+  // dead session carried no .session so the tick never saw it — and the owner's
+  // `iapeer list`→Enter attach then RESUMED the old context, defeating the self-fresh
+  // entirely). The mark is the owner's explicit "come up FRESH next"; ANY wake that
+  // finds it must honor it. Consume-on-fire + clear .idle-reaped (mirror .fresh-next
+  // hygiene: a stale clean-park marker must not make a later crash read as resume).
+  if (hasNewEager(cfg, identity)) {
+    clearNewEager(cfg, identity)
+    clearIdleReaped(cfg, identity)
+    return { resume: false, cause: 'self-fresh-eager' }
+  }
+  // 2. attach → resume, fail-loud if nothing to resume.
   if (argsResume === true) {
     const r = resolveResume(cwd)
     if (!r.ok) return { resume: false, failReason: r.reason ?? 'resume requested but nothing to resume', cause: 'attach-nothing-to-resume' }
@@ -1523,6 +1540,57 @@ export async function processEagerRelaunches(
   return results
 }
 
+/**
+ * ORPHANED eager-mark fallback (live incident 03.07, iapeer-memory): the standard eager
+ * path runs off superviseTick's `.session` walk — a peer whose session died WITHOUT a
+ * `.session` on disk (an unsupervised live session: a lost/never-written state file —
+ * the code even warns "live but UNSUPERVISED" on a state-write failure) is INVISIBLE to
+ * the tick, so its `.new-eager` was never consumed and the peer lay DOWN until an
+ * external stimulus (the owner's attach — which then also resumed the old context).
+ * This scan makes the mark a DURABLE contract independent of `.session`: every daemon
+ * tick, any `.new-eager` whose identity has NO live session AND NO `.session` (the
+ * standard path would have handled that) is relaunched fresh here. Guards: H4
+ * (launchd-managed → never touched), a LIVE session (self-fresh mark→kill window, or a
+ * concurrent wake that already brought it up — the mark stays; the standard path or the
+ * next tick consumes it), and the wake.lock inside wakeOrSpawn serializes against any
+ * concurrent message-wake (which itself now consumes the mark via resolveWakeMode 1.5).
+ */
+export async function processOrphanEagerMarks(
+  cfg: LifecycleConfig,
+  deps: WakeDeps & { wakeFn?: (args: WakeArgs, deps: WakeDeps) => Promise<WakeResult> } = {},
+): Promise<WakeResult[]> {
+  const env = deps.env ?? process.env
+  const wake = deps.wakeFn ?? wakeOrSpawn
+  let entries: string[] = []
+  try {
+    entries = readdirSync(cfg.stateDir).filter(f => f.endsWith('.new-eager'))
+  } catch {
+    return [] // no state dir → no marks
+  }
+  const results: WakeResult[] = []
+  for (const f of entries) {
+    const identity = f.slice(0, -'.new-eager'.length)
+    const addr = parseSessionName(identity)
+    if (!addr) continue
+    if (isLaunchdManaged(addr.personality, env)) continue // H4 — the daemon never touches launchd-owned peers
+    if (existsSync(sessionStatePath(cfg, identity))) continue // standard eager path owns this death
+    const sock = buildSocketPath(addr.runtime, addr.personality, cfg.sockDir)
+    if (sessionAlive(sock, identity, env)) continue // mark→kill window or already re-launched — leave the mark
+    appendLifecycleEvent(
+      cfg.eventLogDir,
+      { ev: 'supervise', identity, action: 'eager-orphan-fresh', reason: 'orphaned .new-eager (no .session, session dead)', outcome: 'eager-fresh' },
+      { env },
+    )
+    clearNewEager(cfg, identity) // consume — the relaunch below is fresh by construction
+    try {
+      results.push(await wake({ personality: addr.personality, runtime: addr.runtime, task: '', resume: false }, { cfg, env }))
+    } catch (e) {
+      results.push({ status: 'FAILED', woke: false, reason: e instanceof Error ? e.message : String(e) })
+    }
+  }
+  return results
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // wake_policy:"ephemeral" M3 — the serial-queue DRAIN. Deliveries to an ephemeral
 // target are always ENQUEUED (transport's injected ephemeral seam → queue.ts);

package/src/supervisor/daemon.ts

@@ -95,6 +95,10 @@ const NAG_STUCK_MS = 10_000
 // so without a budget firstAttach would never complete (frozen attach). On timeout we snapshot the
 // current model; live-forward delivers the rest once the gate lifts.
 const MODEL_STABLE_BUDGET_MS = 500
+/** How long firstAttach waits for the child's SIGWINCH redraw wave to ARRIVE after the attach
+ *  resize (first bytes; the В25-capped stability drain follows). Signal delivery + a full TUI
+ *  redraw take tens of ms; a child that answers SIGWINCH with nothing just costs this timeout. */
+const SIGWINCH_REDRAW_WAIT_MS = 300
 
 // Bun-native PTY (Bun ≥1.3.5) is not yet in @types/bun — type the slice we use.
 interface PtyChild {
@@ -422,36 +426,43 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
     }
     writeGeometry(runDir, session, c, r) // record current child geometry → sidecar for warm-deliver / ready-gate readers
   }
-  // FIRST attach for a client. Order (codex review) for a clean, coloured, correctly-sized snapshot:
+  // FIRST attach for a client. Order for a clean, coloured, correctly-sized snapshot:
   //   1. DRAIN to stability — pending child bytes were generated under the OLD geometry; parse them BEFORE a
   //      model resize (else they rewrap wrong), and capture bytes that land while the client is gated.
-  //   2. MODEL resize to the client geometry IF it differs — serialize() round-trips only at matching dims
-  //      (xterm.js #3093), so the model must be the client's size before we serialize.
-  //   3. SNAPSHOT — serialize + send + lift gate, SYNCHRONOUS (no await), so no live byte interleaves.
-  //   4. CHILD resize IF it differs — an honest one-SIGWINCH window-resize (like native). NOT a nudge, NOT a
-  //      forced repaint: serialize already recreated screen+cursor, so claude's live bytes continue from the
-  //      matching grid. A same-size reattach touches the child ZERO times → pure snapshot, no re-render.
+  //   2. MODEL + CHILD resize to the client geometry IF it differs — BOTH, BEFORE the snapshot. serialize()
+  //      round-trips only at matching dims (xterm.js #3093); and the child's SIGWINCH must fire NOW so its
+  //      full redraw is INGESTED BY THE MODEL (client still gated) instead of being live-forwarded on top
+  //      of an already-sent snapshot. The prior order (child resized AFTER the snapshot) was the attach-dup
+  //      root on a BUSY session (live incident, Артур 03.07): the post-snapshot SIGWINCH redraw arrived as
+  //      live bytes whose relative cursor-ups no longer matched the client screen — the whole block painted
+  //      AGAIN below the snapshot (stacked "Composing…" spinners) — and every busy tick in the window before
+  //      the SIGWINCH was still OLD-width, wrapping into extra phantom rows. Reproduced: 2× spinner + 2×
+  //      content copies in the client buffer; with this order: 1× each.
+  //   3. WAIT for the redraw wave — the same bounded stabilization as step 1 (В25 cap applies: a saturating
+  //      stream snapshots at the deadline; ticks after the snapshot are already client-width, so they land
+  //      cleanly via live-forward).
+  //   4. SNAPSHOT — serialize + send + lift gate, SYNCHRONOUS (no await between the last stability check and
+  //      the send), so no live byte interleaves. A same-size reattach touches the child ZERO times → pure
+  //      snapshot, no re-render (step 2 is a no-op).
+  // Wait for the FIRST child bytes after a resize (the SIGWINCH redraw wave arriving), or the
+  // timeout for a child that answers SIGWINCH with nothing (a plain pipe-like program). A bare
+  // stability check is NOT enough here: signal delivery + redraw generation take milliseconds,
+  // and a busy child's tick cadence has quiet gaps — the stability loop returns in such a gap
+  // BEFORE the redraw arrives (proven by the repro byte log: the \x1b[NA redraw came as frame #2,
+  // after the snapshot), which re-creates the dup exactly.
+  const awaitSeqBump = async (timeoutMs: number): Promise<void> => {
+    const seq = writeSeq
+    const deadline = Date.now() + timeoutMs
+    while (writeSeq === seq && Date.now() < deadline) await Bun.sleep(15)
+  }
   const firstAttach = async (s: { write(b: Buffer): number }, c: number, r: number): Promise<void> => {
     await awaitModelParsedStable()
-    const changed = c !== cols || r !== rows
-    if (changed) {
-      try {
-        xterm.resize(c, r) // MODEL only (for the serialize round-trip) — child resized below, after the snapshot
-      } catch {
-        /* transient */
-      }
-      cols = c
-      rows = r
-    }
-    sendSnapshot(s) // serialize the model → send → lift gate (synchronous, no interleave)
-    if (changed) {
-      try {
-        child.terminal.resize(c, r) // honest one-SIGWINCH resize (post-snapshot, forwarded live), like native
-      } catch {
-        /* transient */
-      }
-      writeGeometry(runDir, session, c, r) // record the new current child geometry for the warm-deliver readers
+    if (c !== cols || r !== rows) {
+      applyGeometry(c, r) // model + child together — one honest SIGWINCH, BEFORE the snapshot
+      await awaitSeqBump(SIGWINCH_REDRAW_WAIT_MS) // the redraw wave ARRIVES (or the child has none)
+      await awaitModelParsedStable() // …then drain it to stability (bounded, В25 cap)
     }
+    sendSnapshot(s) // serialize the post-redraw model → send → lift gate (synchronous, no interleave)
   }
   // DETACH = NO RESIZE (emulator invariant). A detached hosted TUI keeps its LAST client geometry — it is
   // NEVER shrunk back to serve. The old FINDING-2 revert shrank the child into a tiny viewport, making claude