@agfpd/iapeer 0.4.61 → 0.4.63

package/src/daemon/index.ts

@@ -359,6 +359,23 @@ export interface DaemonHandle {
   close: () => Promise<void>
 }
 
+/**
+ * The fleet-API request handler seam (Ф0 iapeer-tray) — the OPERATOR-CLIENT HTTP
+ * surface (/fleet/v1/*: snapshot + SSE events + commands), served on the SAME
+ * listeners behind the SAME bearer gate as the MCP path. Injected by the
+ * composition point (daemon/main.ts wires daemon/fleet.ts's buildFleetHandler) so
+ * the daemon library never imports lifecycle/CLI — the same seam pattern as
+ * wake/supervise. `ctx.deps` is the daemon's wired CallToolDeps: the fleet send
+ * command routes through the SAME callTool path as the MCP tool (delivery.log +
+ * post-delivery hooks included). OFF by default (library/tests): without the seam,
+ * /fleet/* URLs fall through to the MCP handler like any other request.
+ */
+export type FleetRequestHandler = (
+  req: IncomingMessage,
+  res: ServerResponse,
+  ctx: { deps: CallToolDeps },
+) => Promise<void>
+
 export interface StartDaemonOptions extends StorageOptions {
   /**
    * Unix-socket path (H8 base: 0600, same-uid local callers — CLI / pane /
@@ -439,6 +456,12 @@ export interface StartDaemonOptions extends StorageOptions {
   /** H4 launchd-managed detector — see CallToolDeps.isLaunchdManaged / the launchd-revive
    *  delivery retry. OFF by default (library/tests); production main wires the real one. */
   isLaunchdManaged?: (personality: string) => boolean
+  /**
+   * Fleet-API handler (see FleetRequestHandler) — serves /fleet/v1/* on both
+   * listeners, behind the bearer gate. OFF by default; the production main wires
+   * daemon/fleet.ts's buildFleetHandler. Advertised in router.json as `fleet: 1`.
+   */
+  fleet?: FleetRequestHandler
   /**
    * Write the discovery file (router.json) at <root>/state/iapeer/router.json with
    * the active addresses `{sock, tcp}` — atomically on listen, removed on close.
@@ -456,27 +479,51 @@ export async function startDaemon(opts: StartDaemonOptions = {}): Promise<Daemon
   const host = opts.host ?? '127.0.0.1'
   const bearer = opts.bearerToken?.trim() || undefined
 
-  // ONE MCP request handler, shared by EVERY listener (socket + TCP). Stateless:
+  // The ONE wired CallToolDeps object — shared by the per-request MCP servers AND
+  // the fleet-API handler (its send command routes through the SAME callTool path,
+  // so a fleet-originated send gets the identical delivery.log line + hooks).
+  const callDeps: CallToolDeps = {
+    env: opts.env, // Б7 — thread the daemon's storage env into the request path (registry read + routeSend)
+    wake: opts.wake,
+    deliveryLogDir: opts.deliveryLogDir,
+    onDelivered: opts.onDelivered,
+    ephemeral: opts.ephemeral,
+    noteLiveTopic: opts.noteLiveTopic,
+    noteDelivered: opts.noteDelivered,
+    composerQueue: opts.composerQueue,
+    isLaunchdManaged: opts.isLaunchdManaged,
+  }
+
+  // ONE HTTP request handler, shared by EVERY listener (socket + TCP): the bearer
+  // gate first, then the fleet-API branch (when wired), then stateless MCP —
   // a fresh Server + transport per request, fully isolated.
   const handle = (req: IncomingMessage, res: ServerResponse): void => {
-    // H8 bearer layer (FIRST, before any MCP work): when a token is configured,
+    // H8 bearer layer (FIRST, before any MCP/fleet work): when a token is configured,
     // reject anything not carrying `Authorization: Bearer <token>`. Off when unset.
     if (bearer && req.headers.authorization !== `Bearer ${bearer}`) {
       res.writeHead(401, { 'content-type': 'application/json', 'www-authenticate': 'Bearer' })
       res.end(JSON.stringify({ jsonrpc: '2.0', id: null, error: { code: -32001, message: 'unauthorized' } }))
       return
     }
-    const server = createMcpServer({
-      env: opts.env, // Б7 — thread the daemon's storage env into the request path (registry read + routeSend)
-      wake: opts.wake,
-      deliveryLogDir: opts.deliveryLogDir,
-      onDelivered: opts.onDelivered,
-      ephemeral: opts.ephemeral,
-      noteLiveTopic: opts.noteLiveTopic,
-      noteDelivered: opts.noteDelivered,
-      composerQueue: opts.composerQueue,
-      isLaunchdManaged: opts.isLaunchdManaged,
-    })
+    // Fleet-API branch (Ф0 iapeer-tray): /fleet/* is the operator-client surface.
+    // Deliberately AFTER the bearer gate and BEFORE MCP — the two surfaces share
+    // listeners but never overlap in URL space.
+    if (opts.fleet && req.url && (req.url === '/fleet' || req.url.startsWith('/fleet/'))) {
+      void opts.fleet(req, res, { deps: callDeps }).catch(() => {
+        if (!res.headersSent) {
+          res.writeHead(500, { 'content-type': 'application/json' })
+          res.end(JSON.stringify({ error: 'internal error' }))
+        } else {
+          try {
+            res.end()
+          } catch {
+            /* connection already gone */
+          }
+        }
+      })
+      return
+    }
+    const server = createMcpServer(callDeps)
     const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined })
     res.on('close', () => {
       transport.close()
@@ -568,7 +615,12 @@ export async function startDaemon(opts: StartDaemonOptions = {}): Promise<Daemon
     // `version` (В53): the RUNNING daemon's baked version — lets `iapeer update`
     // detect an interrupted update (binary already at latest, live daemon still on
     // the old code) and heal it with a restart instead of a false "already-latest".
-    writeFileAtomic(discoveryPath, `${JSON.stringify({ sock: socketPath ?? null, tcp: url ?? null, version: IAPEER_VERSION })}\n`)
+    // `fleet` (Ф0 iapeer-tray): the fleet-API capability marker — a client reads it
+    // to know this daemon serves /fleet/v1/* (absent on pre-fleet daemons).
+    writeFileAtomic(
+      discoveryPath,
+      `${JSON.stringify({ sock: socketPath ?? null, tcp: url ?? null, version: IAPEER_VERSION, ...(opts.fleet ? { fleet: 1 } : {}) })}\n`,
+    )
   }
 
   const removeArtifacts = (): void => {

package/src/daemon/main.ts

@@ -66,6 +66,7 @@ import {
 } from '../transport/index.ts'
 import { iapeerBinPath } from '../install/index.ts'
 import { appendDeliveryEvent } from './deliverylog.ts'
+import { buildFleetHandler } from './fleet.ts'
 import { defaultDaemonSocketPath, startDaemon, type DaemonHandle } from './index.ts'
 
 /** Default TCP loopback port for the always-on router. Real http MCP clients
@@ -362,6 +363,11 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
     // launchd-managed target (the daemon can't wake it, but KeepAlive revives it) → retry-
     // resolve for a bounded window instead of failing in ~16ms — bridges a router restart.
     isLaunchdManaged: (personality: string) => isLaunchdManaged(personality, env),
+    // Fleet-API (Ф0 iapeer-tray): the operator-client surface /fleet/v1/* — snapshot
+    // (the same listPeers truth as `iapeer list`), SSE events (tail of the durable
+    // logs), commands over the existing verb functions. Same listeners, same bearer
+    // gate; advertised in router.json as fleet:1. Contract: docs/15-fleet-api.md.
+    fleet: buildFleetHandler({ env }),
     supervise: {
       intervalMs: opts.superviseIntervalMs ?? DEFAULT_SUPERVISE_INTERVAL_MS,
       // idle-reap / zombie-sweep, THEN the eager fresh re-launch for any peer whose

package/src/launch/adapters/claude.ts

@@ -100,6 +100,35 @@ function isFullscreenNagOptionRow(row: string): boolean {
   return row.includes('❯') && (row.includes(NAG_OPTION_YES) || /❯\s*1\.\s*Yes/.test(row))
 }
 
+// Dangerous-rm circuit-breaker needles — split-literal (same В40 discipline: a peer reviewing THIS
+// adapter / the doctrine must not self-trigger). Verified verbatim against claude 2.1.201 (Mach-O
+// strings + a live pty capture): the breaker fires for `rm` AND `rmdir` on the cwd/an ancestor, above
+// the permission layer, with a `❯ 1. Yes / 2. No` select whose default cursor is on YES.
+const RM_ANCESTOR = 'working directory or its ' + 'ancestor'
+const RM_PROCEED = 'Do you want to ' + 'proceed?'
+/** FULL-signature + position match for the LIVE dangerous-rm/rmdir confirm (not a mere quote of it):
+ *  the breaker phrase + the proceed prompt + the bottom-most `❯` cursor sitting on the "1. Yes" option. */
+function isDangerousRmPrompt(pane: string): boolean {
+  if (!pane.includes(RM_ANCESTOR) || !pane.includes(RM_PROCEED)) return false
+  let lastCursorRow = ''
+  for (const line of pane.split(/\r?\n/)) if (line.includes('❯')) lastCursorRow = line
+  return /❯\s*1\.\s*Yes\b/.test(lastCursorRow) // live select on Yes; a quote has the ready composer `❯` below
+}
+/** Best-effort one-line trace of WHAT the breaker guarded — the rm/rmdir command line if the pane still
+ *  shows the "Bash command" block, plus the target path printed after "…ancestor:". Owner's post-hoc
+ *  audit hook (which peer / which command / when — `when` + `who` are added by the daemon). */
+function dangerousRmDetail(pane: string): string {
+  const lines = pane.split(/\r?\n/).map(l => l.trim())
+  let target = ''
+  const ai = lines.findIndex(l => l.includes(RM_ANCESTOR))
+  if (ai >= 0) for (let j = ai + 1; j < lines.length; j++) if (lines[j]) { target = lines[j]; break }
+  // ANCHORED to a line that STARTS with rm/rmdir (the "Bash command" block's command line, e.g.
+  // "rm -rf /path"); never a mid-line match, or the composer's echoed user prompt ("…run: rm -rf")
+  // would be captured instead of the actual command.
+  const cmd = lines.find(l => /^rm(?:dir)?\s+\S/.test(l)) ?? ''
+  return [cmd && `cmd=${JSON.stringify(cmd)}`, target && `target=${JSON.stringify(target)}`].filter(Boolean).join(' ') || '(unparsed)'
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Transcript activity proxy + resume uuid (lifecycle port, claude slug fix)
 // ─────────────────────────────────────────────────────────────────────────────
@@ -299,6 +328,21 @@ export const claudeAdapter: RuntimeAdapter = {
     return isFullscreenNagOptionRow(lastCursorRow) ? ['2', 'Enter'] : null
   },
 
+  /**
+   * Dangerous-rm/rmdir circuit-breaker (RuntimeAdapter.blockingConfirm). Unlike the fullscreen nag
+   * (benign upsell → DECLINE), this guard sits ABOVE `--dangerously-skip-permissions` and hangs a
+   * headless peer forever with no human to answer. Owner decision (Артур, 04.07): auto-press YES —
+   * peers run on bypass, so this only restores the pre-2.1.x status quo, and a hang is real recurring
+   * harm. The default cursor is already on "1. Yes" (verified live), so ['1','Enter'] is the explicit,
+   * position-robust affirmative. Returns the class tag + a one-line command/target trace so the
+   * supervisor logs a post-hoc audit line. NB deliberately NOT a "smart" safe-decline/escalation — that
+   * lands later on the vault idea "Human-approval подтверждения действий пира через Telegram-кнопки".
+   */
+  blockingConfirm(pane: string): { keys: string[]; taxonomy: string; detail: string } | null {
+    if (!isDangerousRmPrompt(pane)) return null
+    return { keys: ['1', 'Enter'], taxonomy: 'dangerous-rm', detail: dangerousRmDetail(pane) }
+  },
+
   /**
    * Ready for the first message iff the input surface is rendered AND no startup
    * dialog is still up (lifecycle.claudeInputReady, index.ts:272-279;

package/src/launch/types.ts

@@ -299,6 +299,22 @@ export interface RuntimeAdapter {
    */
   nagDismissKeys?(pane: string): string[] | null
 
+  /**
+   * MID-SESSION blocking CIRCUIT-BREAKER confirm (livability + safety). A sibling of nagDismissKeys
+   * for a DIFFERENT class: an interactive confirm that even `--dangerously-skip-permissions` does NOT
+   * bypass because it sits ABOVE the permission layer — the "Dangerous rm operation on working
+   * directory or its ancestor / Do you want to proceed? 1.Yes 2.No" guard claude 2.1.x added (no env,
+   * settings, or flag disables it). A headless peer has no human to press 1/2, so it HANGS forever
+   * (live-observed on a verification session). Owner decision (Артур, 04.07): auto-press YES — peers
+   * already run on bypass, so this only restores the pre-2.1.x status quo; a hang is real recurring
+   * harm. Return `{keys, taxonomy, detail}` (the affirmative keys + a class tag + a one-line trace of
+   * WHAT was approved) so the supervisor can press it AND leave a post-hoc log; else null. Match the
+   * FULL signature + cursor position so ordinary content mentioning the phrase never fires. Optional
+   * (codex/router omit it). tui only. FUTURE: replace blind-YES with human approval via Telegram —
+   * see the vault idea "Human-approval подтверждения действий пира через Telegram-кнопки".
+   */
+  blockingConfirm?(pane: string): { keys: string[]; taxonomy: string; detail: string } | null
+
   /** Is the input surface ready for the first message? (tui: ready marker present
    *  AND startup dialogs gone). Router runtimes return true (no input surface). */
   isInputReady(pane: string): boolean

package/src/supervisor/boot.ts

@@ -33,23 +33,33 @@ export function nextBootAction(adapter: BootPredicates, viewport: string, enc: K
   return { kind: 'wait' }
 }
 
-/** The slice of a RuntimeAdapter the MID-SESSION nag-watcher consumes — the optional
- *  nagDismissKeys (claudeAdapter satisfies it; codex/router omit it → no nags). */
+/** The slice of a RuntimeAdapter the MID-SESSION nag-watcher consumes — the optional nagDismissKeys
+ *  (benign upsell → silent decline) + blockingConfirm (circuit-breaker → affirmative + audit log).
+ *  claudeAdapter satisfies both; codex/router omit them → no action. */
 export interface NagPredicate {
   nagDismissKeys?(pane: string): string[] | null
+  blockingConfirm?(pane: string): { keys: string[]; taxonomy: string; detail: string } | null
 }
 
-export type NagAction = { kind: 'dismiss'; keys: string[]; bytes: Buffer } | { kind: 'none' }
+export type NagAction =
+  | { kind: 'dismiss'; keys: string[]; bytes: Buffer } // benign upsell — press keys silently
+  | { kind: 'approve'; keys: string[]; bytes: Buffer; taxonomy: string; detail: string } // circuit-breaker — press keys + LOG
+  | { kind: 'none' }
 
 /**
- * MID-SESSION nag/upsell step (livability) — the persistent sibling of nextBootAction. Unlike the
- * boot-driver, which STOPS at ready, the daemon loops this for the WHOLE session: a one-time CC upsell
- * modal (e.g. "Try the new fullscreen-renderer?") can pop AFTER the session is live and BLOCK the pty on
- * a keypress no headless peer answers. If the adapter recognizes the (FULL-signature) modal it returns
- * the verified-safe DECLINE keys; the caller writes `action.bytes` to the pty (cooldown-guarded so a
- * cleared modal is never double-answered). An adapter with no nagDismissKeys → always 'none'.
+ * MID-SESSION nag/confirm step (livability) — the persistent sibling of nextBootAction. Unlike the
+ * boot-driver (which STOPS at ready), the daemon loops this for the WHOLE session for TWO classes of
+ * mid-session blocking prompt no headless peer can answer:
+ *   1. a CIRCUIT-BREAKER confirm (blockingConfirm — e.g. the dangerous-rm guard above the permission
+ *      layer) → press the affirmative AND surface a `detail`/`taxonomy` the caller logs (owner audit);
+ *   2. a benign UPSELL modal (nagDismissKeys — e.g. "Try the new fullscreen-renderer?") → decline silently.
+ * The circuit-breaker is checked FIRST (safety-relevant). The caller writes `action.bytes` (cooldown- +
+ * stuck-gate-guarded so a cleared prompt is never double-answered). An adapter with neither → 'none'.
  */
 export function nextNagAction(adapter: NagPredicate, viewport: string, enc: KeyEncoding = {}): NagAction {
+  const confirm = adapter.blockingConfirm?.(viewport)
+  if (confirm && confirm.keys.length)
+    return { kind: 'approve', keys: confirm.keys, bytes: keysToBytes(confirm.keys, enc), taxonomy: confirm.taxonomy, detail: confirm.detail }
   const keys = adapter.nagDismissKeys?.(viewport)
   if (keys && keys.length) return { kind: 'dismiss', keys, bytes: keysToBytes(keys, enc) }
   return { kind: 'none' }

package/src/supervisor/daemon.ts

@@ -643,7 +643,7 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
   // NAG_COOLDOWN_MS so a just-dismissed modal is never double-answered (a stray keystroke would land in
   // the now-visible composer). Only runs for a runtime whose adapter declares nagDismissKeys.
   const nagAdapter = BOOT_ADAPTERS[runtime] as NagPredicate | undefined
-  if (nagAdapter?.nagDismissKeys) {
+  if (nagAdapter?.nagDismissKeys || nagAdapter?.blockingConfirm) {
     let nagFiredMs = 0
     // В60 — stuck-gate: a REAL blocked modal freezes the pty entirely, while a live peer merely
     // RENDERING the modal text (code review / quoted report — the В40 false-fire class) keeps
@@ -667,6 +667,22 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
       if (action.kind === 'dismiss') {
         child.terminal.write(action.bytes)
         nagFiredMs = Date.now()
+      } else if (action.kind === 'approve') {
+        // CIRCUIT-BREAKER confirm (e.g. dangerous-rm) — press the affirmative so a headless peer never
+        // hangs on it (owner decision: auto-YES restores the pre-2.1.x bypass status quo). Leave a
+        // post-hoc AUDIT line in the supervisor's own log (console → logPath): WHICH peer (session),
+        // WHAT (taxonomy + the parsed command/target), WHEN (ts). A rare bad rm is then at least visible
+        // after the fact — the interim before human-approval (Telegram) lands. Best-effort log, never
+        // gates the keypress.
+        child.terminal.write(action.bytes)
+        nagFiredMs = Date.now()
+        try {
+          console.warn(
+            `[supervisor] AUTO-CONFIRM ${action.taxonomy} identity=${session} ts=${new Date().toISOString()} ${action.detail}`,
+          )
+        } catch {
+          /* logging must never break the conduit */
+        }
       }
     }, NAG_POLL_MS)
     ;(nagWatch as { unref?: () => void }).unref?.()

package/src/tui/dashboard/data.ts

@@ -6,12 +6,12 @@
 // All paths resolve through the injected env → the same IAPEER_ROOT isolation as
 // every other side-effect (sandbox rule). Reads only — the dashboard mutates nothing.
 
-import { closeSync, openSync, readSync, statSync } from 'node:fs'
 import { join } from 'node:path'
 import { listPeers, type PeerListing } from '../../cli/index.ts'
 import { loadLifecycleConfig } from '../../lifecycle/index.ts'
 import { deliveryLogPath } from '../../daemon/deliverylog.ts'
 import { lifecycleLogPath } from '../../lifecycle/eventlog.ts'
+import { readLogTail } from '../../storage/rotatelog.ts'
 import { assemblePeerLog } from './model.ts'
 
 /** One peers snapshot (the poll unit). listPeers is synchronous and cheap: registry
@@ -42,26 +42,10 @@ export async function takeHostHeader(env: NodeJS.ProcessEnv): Promise<HostHeader
   }
 }
 
-/** Read the last `bytes` of a file without loading the whole log (delivery.log can
- *  be MBs before rotation). Missing/unreadable file → ''. */
-export function readTail(path: string, bytes = 64 * 1024): string {
-  try {
-    const size = statSync(path).size
-    const fd = openSync(path, 'r')
-    try {
-      const start = Math.max(0, size - bytes)
-      const buf = Buffer.alloc(size - start)
-      readSync(fd, buf, 0, buf.length, start)
-      // drop the leading partial line when we started mid-file
-      const s = buf.toString('utf8')
-      return start > 0 ? s.slice(s.indexOf('\n') + 1) : s
-    } finally {
-      closeSync(fd)
-    }
-  } catch {
-    return ''
-  }
-}
+/** Read the last `bytes` of a file without loading the whole log. Promoted to the
+ *  storage layer (readLogTail — the fleet-API replay reader shares it); kept as a
+ *  re-export so dashboard call sites/tests are untouched. */
+export const readTail: (path: string, bytes?: number) => string = readLogTail
 
 /** The per-peer log panel content: newest `limit` events concerning the peer from
  *  delivery.log + lifecycle.log (merged by timestamp). */

package/src/tui/dashboard/model.ts

@@ -8,6 +8,7 @@
 // under `bun test` with zero terminal plumbing.
 
 import type { PeerListing } from '../../cli/index.ts'
+import { eventConcernsPeer as concernsPeer, parseEventLine as parseLogfmtLine } from '../../storage/rotatelog.ts'
 
 // ─── row filtering ───────────────────────────────────────────────────────────
 
@@ -55,36 +56,22 @@ export interface LogEvent {
   fields: Record<string, string>
 }
 
-/** Parse one `ts=<iso> ev=<kind> k=v …` line; null for anything else (corrupt tail). */
+/** Parse one `ts=<iso> ev=<kind> k=v …` line; null for anything else (corrupt tail).
+ *  Delegates to the storage-layer QUOTE-AWARE parser (the writer's symmetric read
+ *  half) and adds the display time — the earlier display-only tokenizer split quoted
+ *  multi-word values (reason="idle 3700s") mid-value. */
 export function parseEventLine(line: string): LogEvent | null {
-  if (!line.startsWith('ts=')) return null
-  const fields: Record<string, string> = {}
-  // k=v tokens; values are token-atomic in our append format (no embedded spaces).
-  for (const tok of line.split(' ')) {
-    const i = tok.indexOf('=')
-    if (i > 0) fields[tok.slice(0, i)] = tok.slice(i + 1)
-  }
-  const ts = fields.ts
-  const ev = fields.ev
-  if (!ts || !ev) return null
-  const tsMs = Date.parse(ts)
-  if (!Number.isFinite(tsMs)) return null
-  const d = new Date(tsMs)
+  const p = parseLogfmtLine(line)
+  if (!p) return null
+  const d = new Date(p.tsMs)
   const pad = (n: number): string => String(n).padStart(2, '0')
-  return { tsMs, time: `${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`, ev, fields }
+  return { tsMs: p.tsMs, time: `${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`, ev: p.ev, fields: p.fields }
 }
 
 /** Does this event concern the peer? Matches bare personality and any `<rt>-<personality>`
- *  identity in the fields the two logs actually carry (to/caller/via/personality/identity). */
-export function eventConcernsPeer(e: LogEvent, personality: string): boolean {
-  const idSuffix = `-${personality}`
-  for (const key of ['to', 'caller', 'via', 'personality', 'identity', 'from', 'peer'] as const) {
-    const v = e.fields[key]
-    if (!v) continue
-    if (v === personality || v.endsWith(idSuffix)) return true
-  }
-  return false
-}
+ *  identity in the fields the two logs actually carry (to/caller/via/personality/identity).
+ *  Re-exported from the storage layer (the fleet peer-detail endpoint shares it). */
+export const eventConcernsPeer: (e: LogEvent, personality: string) => boolean = concernsPeer
 
 /** One display line per event — compact, the interesting fields only. */
 export function formatEvent(e: LogEvent): { text: string; tone: 'ok' | 'fail' | 'info' } {