@agfpd/iapeer 0.4.61 → 0.4.62

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.61",
+  "version": "0.4.62",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/launch/adapters/claude.ts

@@ -100,6 +100,35 @@ function isFullscreenNagOptionRow(row: string): boolean {
   return row.includes('❯') && (row.includes(NAG_OPTION_YES) || /❯\s*1\.\s*Yes/.test(row))
 }
 
+// Dangerous-rm circuit-breaker needles — split-literal (same В40 discipline: a peer reviewing THIS
+// adapter / the doctrine must not self-trigger). Verified verbatim against claude 2.1.201 (Mach-O
+// strings + a live pty capture): the breaker fires for `rm` AND `rmdir` on the cwd/an ancestor, above
+// the permission layer, with a `❯ 1. Yes / 2. No` select whose default cursor is on YES.
+const RM_ANCESTOR = 'working directory or its ' + 'ancestor'
+const RM_PROCEED = 'Do you want to ' + 'proceed?'
+/** FULL-signature + position match for the LIVE dangerous-rm/rmdir confirm (not a mere quote of it):
+ *  the breaker phrase + the proceed prompt + the bottom-most `❯` cursor sitting on the "1. Yes" option. */
+function isDangerousRmPrompt(pane: string): boolean {
+  if (!pane.includes(RM_ANCESTOR) || !pane.includes(RM_PROCEED)) return false
+  let lastCursorRow = ''
+  for (const line of pane.split(/\r?\n/)) if (line.includes('❯')) lastCursorRow = line
+  return /❯\s*1\.\s*Yes\b/.test(lastCursorRow) // live select on Yes; a quote has the ready composer `❯` below
+}
+/** Best-effort one-line trace of WHAT the breaker guarded — the rm/rmdir command line if the pane still
+ *  shows the "Bash command" block, plus the target path printed after "…ancestor:". Owner's post-hoc
+ *  audit hook (which peer / which command / when — `when` + `who` are added by the daemon). */
+function dangerousRmDetail(pane: string): string {
+  const lines = pane.split(/\r?\n/).map(l => l.trim())
+  let target = ''
+  const ai = lines.findIndex(l => l.includes(RM_ANCESTOR))
+  if (ai >= 0) for (let j = ai + 1; j < lines.length; j++) if (lines[j]) { target = lines[j]; break }
+  // ANCHORED to a line that STARTS with rm/rmdir (the "Bash command" block's command line, e.g.
+  // "rm -rf /path"); never a mid-line match, or the composer's echoed user prompt ("…run: rm -rf")
+  // would be captured instead of the actual command.
+  const cmd = lines.find(l => /^rm(?:dir)?\s+\S/.test(l)) ?? ''
+  return [cmd && `cmd=${JSON.stringify(cmd)}`, target && `target=${JSON.stringify(target)}`].filter(Boolean).join(' ') || '(unparsed)'
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Transcript activity proxy + resume uuid (lifecycle port, claude slug fix)
 // ─────────────────────────────────────────────────────────────────────────────
@@ -299,6 +328,21 @@ export const claudeAdapter: RuntimeAdapter = {
     return isFullscreenNagOptionRow(lastCursorRow) ? ['2', 'Enter'] : null
   },
 
+  /**
+   * Dangerous-rm/rmdir circuit-breaker (RuntimeAdapter.blockingConfirm). Unlike the fullscreen nag
+   * (benign upsell → DECLINE), this guard sits ABOVE `--dangerously-skip-permissions` and hangs a
+   * headless peer forever with no human to answer. Owner decision (Артур, 04.07): auto-press YES —
+   * peers run on bypass, so this only restores the pre-2.1.x status quo, and a hang is real recurring
+   * harm. The default cursor is already on "1. Yes" (verified live), so ['1','Enter'] is the explicit,
+   * position-robust affirmative. Returns the class tag + a one-line command/target trace so the
+   * supervisor logs a post-hoc audit line. NB deliberately NOT a "smart" safe-decline/escalation — that
+   * lands later on the vault idea "Human-approval подтверждения действий пира через Telegram-кнопки".
+   */
+  blockingConfirm(pane: string): { keys: string[]; taxonomy: string; detail: string } | null {
+    if (!isDangerousRmPrompt(pane)) return null
+    return { keys: ['1', 'Enter'], taxonomy: 'dangerous-rm', detail: dangerousRmDetail(pane) }
+  },
+
   /**
    * Ready for the first message iff the input surface is rendered AND no startup
    * dialog is still up (lifecycle.claudeInputReady, index.ts:272-279;

package/src/launch/types.ts

@@ -299,6 +299,22 @@ export interface RuntimeAdapter {
    */
   nagDismissKeys?(pane: string): string[] | null
 
+  /**
+   * MID-SESSION blocking CIRCUIT-BREAKER confirm (livability + safety). A sibling of nagDismissKeys
+   * for a DIFFERENT class: an interactive confirm that even `--dangerously-skip-permissions` does NOT
+   * bypass because it sits ABOVE the permission layer — the "Dangerous rm operation on working
+   * directory or its ancestor / Do you want to proceed? 1.Yes 2.No" guard claude 2.1.x added (no env,
+   * settings, or flag disables it). A headless peer has no human to press 1/2, so it HANGS forever
+   * (live-observed on a verification session). Owner decision (Артур, 04.07): auto-press YES — peers
+   * already run on bypass, so this only restores the pre-2.1.x status quo; a hang is real recurring
+   * harm. Return `{keys, taxonomy, detail}` (the affirmative keys + a class tag + a one-line trace of
+   * WHAT was approved) so the supervisor can press it AND leave a post-hoc log; else null. Match the
+   * FULL signature + cursor position so ordinary content mentioning the phrase never fires. Optional
+   * (codex/router omit it). tui only. FUTURE: replace blind-YES with human approval via Telegram —
+   * see the vault idea "Human-approval подтверждения действий пира через Telegram-кнопки".
+   */
+  blockingConfirm?(pane: string): { keys: string[]; taxonomy: string; detail: string } | null
+
   /** Is the input surface ready for the first message? (tui: ready marker present
    *  AND startup dialogs gone). Router runtimes return true (no input surface). */
   isInputReady(pane: string): boolean

package/src/supervisor/boot.ts

@@ -33,23 +33,33 @@ export function nextBootAction(adapter: BootPredicates, viewport: string, enc: K
   return { kind: 'wait' }
 }
 
-/** The slice of a RuntimeAdapter the MID-SESSION nag-watcher consumes — the optional
- *  nagDismissKeys (claudeAdapter satisfies it; codex/router omit it → no nags). */
+/** The slice of a RuntimeAdapter the MID-SESSION nag-watcher consumes — the optional nagDismissKeys
+ *  (benign upsell → silent decline) + blockingConfirm (circuit-breaker → affirmative + audit log).
+ *  claudeAdapter satisfies both; codex/router omit them → no action. */
 export interface NagPredicate {
   nagDismissKeys?(pane: string): string[] | null
+  blockingConfirm?(pane: string): { keys: string[]; taxonomy: string; detail: string } | null
 }
 
-export type NagAction = { kind: 'dismiss'; keys: string[]; bytes: Buffer } | { kind: 'none' }
+export type NagAction =
+  | { kind: 'dismiss'; keys: string[]; bytes: Buffer } // benign upsell — press keys silently
+  | { kind: 'approve'; keys: string[]; bytes: Buffer; taxonomy: string; detail: string } // circuit-breaker — press keys + LOG
+  | { kind: 'none' }
 
 /**
- * MID-SESSION nag/upsell step (livability) — the persistent sibling of nextBootAction. Unlike the
- * boot-driver, which STOPS at ready, the daemon loops this for the WHOLE session: a one-time CC upsell
- * modal (e.g. "Try the new fullscreen-renderer?") can pop AFTER the session is live and BLOCK the pty on
- * a keypress no headless peer answers. If the adapter recognizes the (FULL-signature) modal it returns
- * the verified-safe DECLINE keys; the caller writes `action.bytes` to the pty (cooldown-guarded so a
- * cleared modal is never double-answered). An adapter with no nagDismissKeys → always 'none'.
+ * MID-SESSION nag/confirm step (livability) — the persistent sibling of nextBootAction. Unlike the
+ * boot-driver (which STOPS at ready), the daemon loops this for the WHOLE session for TWO classes of
+ * mid-session blocking prompt no headless peer can answer:
+ *   1. a CIRCUIT-BREAKER confirm (blockingConfirm — e.g. the dangerous-rm guard above the permission
+ *      layer) → press the affirmative AND surface a `detail`/`taxonomy` the caller logs (owner audit);
+ *   2. a benign UPSELL modal (nagDismissKeys — e.g. "Try the new fullscreen-renderer?") → decline silently.
+ * The circuit-breaker is checked FIRST (safety-relevant). The caller writes `action.bytes` (cooldown- +
+ * stuck-gate-guarded so a cleared prompt is never double-answered). An adapter with neither → 'none'.
  */
 export function nextNagAction(adapter: NagPredicate, viewport: string, enc: KeyEncoding = {}): NagAction {
+  const confirm = adapter.blockingConfirm?.(viewport)
+  if (confirm && confirm.keys.length)
+    return { kind: 'approve', keys: confirm.keys, bytes: keysToBytes(confirm.keys, enc), taxonomy: confirm.taxonomy, detail: confirm.detail }
   const keys = adapter.nagDismissKeys?.(viewport)
   if (keys && keys.length) return { kind: 'dismiss', keys, bytes: keysToBytes(keys, enc) }
   return { kind: 'none' }

package/src/supervisor/daemon.ts

@@ -643,7 +643,7 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
   // NAG_COOLDOWN_MS so a just-dismissed modal is never double-answered (a stray keystroke would land in
   // the now-visible composer). Only runs for a runtime whose adapter declares nagDismissKeys.
   const nagAdapter = BOOT_ADAPTERS[runtime] as NagPredicate | undefined
-  if (nagAdapter?.nagDismissKeys) {
+  if (nagAdapter?.nagDismissKeys || nagAdapter?.blockingConfirm) {
     let nagFiredMs = 0
     // В60 — stuck-gate: a REAL blocked modal freezes the pty entirely, while a live peer merely
     // RENDERING the modal text (code review / quoted report — the В40 false-fire class) keeps
@@ -667,6 +667,22 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
       if (action.kind === 'dismiss') {
         child.terminal.write(action.bytes)
         nagFiredMs = Date.now()
+      } else if (action.kind === 'approve') {
+        // CIRCUIT-BREAKER confirm (e.g. dangerous-rm) — press the affirmative so a headless peer never
+        // hangs on it (owner decision: auto-YES restores the pre-2.1.x bypass status quo). Leave a
+        // post-hoc AUDIT line in the supervisor's own log (console → logPath): WHICH peer (session),
+        // WHAT (taxonomy + the parsed command/target), WHEN (ts). A rare bad rm is then at least visible
+        // after the fact — the interim before human-approval (Telegram) lands. Best-effort log, never
+        // gates the keypress.
+        child.terminal.write(action.bytes)
+        nagFiredMs = Date.now()
+        try {
+          console.warn(
+            `[supervisor] AUTO-CONFIRM ${action.taxonomy} identity=${session} ts=${new Date().toISOString()} ${action.detail}`,
+          )
+        } catch {
+          /* logging must never break the conduit */
+        }
       }
     }, NAG_POLL_MS)
     ;(nagWatch as { unref?: () => void }).unref?.()