@agfpd/iapeer 0.4.62 → 0.4.64

package/src/daemon/index.ts

@@ -359,6 +359,23 @@ export interface DaemonHandle {
   close: () => Promise<void>
 }
 
+/**
+ * The fleet-API request handler seam (Ф0 iapeer-tray) — the OPERATOR-CLIENT HTTP
+ * surface (/fleet/v1/*: snapshot + SSE events + commands), served on the SAME
+ * listeners behind the SAME bearer gate as the MCP path. Injected by the
+ * composition point (daemon/main.ts wires daemon/fleet.ts's buildFleetHandler) so
+ * the daemon library never imports lifecycle/CLI — the same seam pattern as
+ * wake/supervise. `ctx.deps` is the daemon's wired CallToolDeps: the fleet send
+ * command routes through the SAME callTool path as the MCP tool (delivery.log +
+ * post-delivery hooks included). OFF by default (library/tests): without the seam,
+ * /fleet/* URLs fall through to the MCP handler like any other request.
+ */
+export type FleetRequestHandler = (
+  req: IncomingMessage,
+  res: ServerResponse,
+  ctx: { deps: CallToolDeps },
+) => Promise<void>
+
 export interface StartDaemonOptions extends StorageOptions {
   /**
    * Unix-socket path (H8 base: 0600, same-uid local callers — CLI / pane /
@@ -439,6 +456,12 @@ export interface StartDaemonOptions extends StorageOptions {
   /** H4 launchd-managed detector — see CallToolDeps.isLaunchdManaged / the launchd-revive
    *  delivery retry. OFF by default (library/tests); production main wires the real one. */
   isLaunchdManaged?: (personality: string) => boolean
+  /**
+   * Fleet-API handler (see FleetRequestHandler) — serves /fleet/v1/* on both
+   * listeners, behind the bearer gate. OFF by default; the production main wires
+   * daemon/fleet.ts's buildFleetHandler. Advertised in router.json as `fleet: 1`.
+   */
+  fleet?: FleetRequestHandler
   /**
    * Write the discovery file (router.json) at <root>/state/iapeer/router.json with
    * the active addresses `{sock, tcp}` — atomically on listen, removed on close.
@@ -456,27 +479,51 @@ export async function startDaemon(opts: StartDaemonOptions = {}): Promise<Daemon
   const host = opts.host ?? '127.0.0.1'
   const bearer = opts.bearerToken?.trim() || undefined
 
-  // ONE MCP request handler, shared by EVERY listener (socket + TCP). Stateless:
+  // The ONE wired CallToolDeps object — shared by the per-request MCP servers AND
+  // the fleet-API handler (its send command routes through the SAME callTool path,
+  // so a fleet-originated send gets the identical delivery.log line + hooks).
+  const callDeps: CallToolDeps = {
+    env: opts.env, // Б7 — thread the daemon's storage env into the request path (registry read + routeSend)
+    wake: opts.wake,
+    deliveryLogDir: opts.deliveryLogDir,
+    onDelivered: opts.onDelivered,
+    ephemeral: opts.ephemeral,
+    noteLiveTopic: opts.noteLiveTopic,
+    noteDelivered: opts.noteDelivered,
+    composerQueue: opts.composerQueue,
+    isLaunchdManaged: opts.isLaunchdManaged,
+  }
+
+  // ONE HTTP request handler, shared by EVERY listener (socket + TCP): the bearer
+  // gate first, then the fleet-API branch (when wired), then stateless MCP —
   // a fresh Server + transport per request, fully isolated.
   const handle = (req: IncomingMessage, res: ServerResponse): void => {
-    // H8 bearer layer (FIRST, before any MCP work): when a token is configured,
+    // H8 bearer layer (FIRST, before any MCP/fleet work): when a token is configured,
     // reject anything not carrying `Authorization: Bearer <token>`. Off when unset.
     if (bearer && req.headers.authorization !== `Bearer ${bearer}`) {
       res.writeHead(401, { 'content-type': 'application/json', 'www-authenticate': 'Bearer' })
       res.end(JSON.stringify({ jsonrpc: '2.0', id: null, error: { code: -32001, message: 'unauthorized' } }))
       return
     }
-    const server = createMcpServer({
-      env: opts.env, // Б7 — thread the daemon's storage env into the request path (registry read + routeSend)
-      wake: opts.wake,
-      deliveryLogDir: opts.deliveryLogDir,
-      onDelivered: opts.onDelivered,
-      ephemeral: opts.ephemeral,
-      noteLiveTopic: opts.noteLiveTopic,
-      noteDelivered: opts.noteDelivered,
-      composerQueue: opts.composerQueue,
-      isLaunchdManaged: opts.isLaunchdManaged,
-    })
+    // Fleet-API branch (Ф0 iapeer-tray): /fleet/* is the operator-client surface.
+    // Deliberately AFTER the bearer gate and BEFORE MCP — the two surfaces share
+    // listeners but never overlap in URL space.
+    if (opts.fleet && req.url && (req.url === '/fleet' || req.url.startsWith('/fleet/'))) {
+      void opts.fleet(req, res, { deps: callDeps }).catch(() => {
+        if (!res.headersSent) {
+          res.writeHead(500, { 'content-type': 'application/json' })
+          res.end(JSON.stringify({ error: 'internal error' }))
+        } else {
+          try {
+            res.end()
+          } catch {
+            /* connection already gone */
+          }
+        }
+      })
+      return
+    }
+    const server = createMcpServer(callDeps)
     const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined })
     res.on('close', () => {
       transport.close()
@@ -568,7 +615,12 @@ export async function startDaemon(opts: StartDaemonOptions = {}): Promise<Daemon
     // `version` (В53): the RUNNING daemon's baked version — lets `iapeer update`
     // detect an interrupted update (binary already at latest, live daemon still on
     // the old code) and heal it with a restart instead of a false "already-latest".
-    writeFileAtomic(discoveryPath, `${JSON.stringify({ sock: socketPath ?? null, tcp: url ?? null, version: IAPEER_VERSION })}\n`)
+    // `fleet` (Ф0 iapeer-tray): the fleet-API capability marker — a client reads it
+    // to know this daemon serves /fleet/v1/* (absent on pre-fleet daemons).
+    writeFileAtomic(
+      discoveryPath,
+      `${JSON.stringify({ sock: socketPath ?? null, tcp: url ?? null, version: IAPEER_VERSION, ...(opts.fleet ? { fleet: 1 } : {}) })}\n`,
+    )
   }
 
   const removeArtifacts = (): void => {

package/src/daemon/main.ts

@@ -66,6 +66,7 @@ import {
 } from '../transport/index.ts'
 import { iapeerBinPath } from '../install/index.ts'
 import { appendDeliveryEvent } from './deliverylog.ts'
+import { buildFleetHandler } from './fleet.ts'
 import { defaultDaemonSocketPath, startDaemon, type DaemonHandle } from './index.ts'
 
 /** Default TCP loopback port for the always-on router. Real http MCP clients
@@ -362,6 +363,11 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
     // launchd-managed target (the daemon can't wake it, but KeepAlive revives it) → retry-
     // resolve for a bounded window instead of failing in ~16ms — bridges a router restart.
     isLaunchdManaged: (personality: string) => isLaunchdManaged(personality, env),
+    // Fleet-API (Ф0 iapeer-tray): the operator-client surface /fleet/v1/* — snapshot
+    // (the same listPeers truth as `iapeer list`), SSE events (tail of the durable
+    // logs), commands over the existing verb functions. Same listeners, same bearer
+    // gate; advertised in router.json as fleet:1. Contract: docs/15-fleet-api.md.
+    fleet: buildFleetHandler({ env }),
     supervise: {
       intervalMs: opts.superviseIntervalMs ?? DEFAULT_SUPERVISE_INTERVAL_MS,
       // idle-reap / zombie-sweep, THEN the eager fresh re-launch for any peer whose

package/src/supervisor/daemon.ts

@@ -25,6 +25,7 @@ import {
   splitDanglingEscape,
   stripQueries,
 } from './protocol.ts'
+import { formatEventLine } from '../storage/rotatelog.ts'
 import { attachedPath, geometryPath, pidPath, servePath, sockPath, writeGeometry, writePidFile } from './paths.ts'
 import { newStuckGate, nextBootAction, nextNagAction, paneIsStuck, type BootPredicates, type NagPredicate } from './boot.ts'
 import { modelToPlainText } from './render.ts'
@@ -289,6 +290,30 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
     return ok
   }
 
+  // ── death-trace (fleet-API follow-up, 05.07) ──────────────────────────────────
+  // exits.log is the durable «why did this session end» record. Before this, ONLY a
+  // child that died on its own (exit callback below) wrote a line; a SIGTERM'd
+  // supervisor (reap / stop / new / self-fresh — EVERY daemon-initiated teardown)
+  // killed the child and process.exit'ed before the callback could run, and a
+  // supervisor crash left nothing at all — exits.log stayed silent for weeks while
+  // sessions died (live gap: claude-boris server-dead 04.07 23:59 with ZERO forensics;
+  // the supervise classification even points the investigator at exits.log). Now every
+  // in-process exit path writes exactly one line: `exitLogged` dedups the child-exit
+  // callback vs the shutdown path. logfmt via the shared writer (quoted values parse
+  // intact in the fleet SSE stream). Out-of-process deaths (SIGKILL / OOM / Bun panic)
+  // remain unrecordable from here by nature — for those the supervise-tick reaped-gone
+  // classification in lifecycle.log stays the only trace.
+  let exitLogged = false
+  const appendExitEvent = (fields: Record<string, string | number | undefined>): void => {
+    if (!opts.exitLogPath) return
+    try {
+      mkdirSync(dirname(opts.exitLogPath), { recursive: true, mode: 0o700 })
+      appendFileSync(opts.exitLogPath, `${formatEventLine(Date.now(), fields)}\n`)
+    } catch {
+      /* best-effort — the trace must never block serving/teardown */
+    }
+  }
+
   const child = Bun.spawn(CMD, {
     cwd: opts.cwd ?? runDir,
     env,
@@ -337,20 +362,18 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
         // supervise-tick death classification + crash-loop accounting have the cause. host=supervisor
         // distinguishes the source. The Bun-native pty exit callback passes (exitCode, signalCode) like
         // onExit; fall back to the subprocess props. Best-effort — never blocks shutdown.
-        if (opts.exitLogPath) {
-          try {
-            mkdirSync(dirname(opts.exitLogPath), { recursive: true, mode: 0o700 }) // ensure the exits.log dir exists
-            const c = child as { exitCode?: number | null; signalCode?: number | null }
-            const status = exitCode ?? c.exitCode ?? ''
-            const signal = signalCode ?? c.signalCode ?? ''
-            appendFileSync(
-              opts.exitLogPath,
-              `ts=${new Date().toISOString()} ev=session-exit identity=${session} dead_status=${status} dead_signal=${signal} host=supervisor\n`,
-            )
-          } catch {
-            /* best-effort */
-          }
-        }
+        const c = child as { exitCode?: number | null; signalCode?: number | null }
+        const status = exitCode ?? c.exitCode
+        const signal = signalCode ?? c.signalCode
+        exitLogged = true // this IS the death record — shutdown below must not write a second one
+        appendExitEvent({
+          ev: 'session-exit',
+          identity: session,
+          dead_status: status ?? '',
+          dead_signal: signal ?? '',
+          cause: 'child-exit',
+          host: 'supervisor',
+        })
         shutdown()
       },
     },
@@ -554,9 +577,17 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
   writeGeometry(runDir, session, serveCols, serveRows) // initial geometry sidecar (= serve); updated on every real child resize
 
   let down = false
-  function shutdown(): void {
+  function shutdown(cause = 'shutdown'): void {
     if (down) return
     down = true
+    // Death-trace: a signalled shutdown kills the child below and process.exit()s
+    // immediately — the child exit callback never runs, so THIS is the only chance
+    // to record the session's end. `exitLogged` is already set when the child died
+    // on its own (the callback wrote the authoritative dead_status/dead_signal line).
+    if (!exitLogged) {
+      exitLogged = true
+      appendExitEvent({ ev: 'session-exit', identity: session, cause, host: 'supervisor' })
+    }
     if (paneLogFd >= 0)
       try {
         closeSync(paneLogFd)
@@ -582,18 +613,31 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
     }
     process.exit(0)
   }
-  process.on('SIGTERM', shutdown)
-  process.on('SIGINT', shutdown)
+  process.on('SIGTERM', () => shutdown('shutdown-sigterm'))
+  process.on('SIGINT', () => shutdown('shutdown-sigint'))
   process.on('SIGHUP', () => {
     /* daemon survives client window close */
   })
-  process.on('uncaughtException', e => {
+  // A survivable fault must still leave a trace: the console.error goes to the
+  // detached daemon's session log, which sat at 0 bytes for weeks on the live fleet —
+  // effectively invisible. Record it in exits.log too (ev=supervisor-uncaught; the
+  // session keeps serving — killing it here would regress the detach-crash robustness),
+  // so a later wedge/death postmortem can see the fault that preceded it.
+  const traceFault = (kind: string, e: unknown): void => {
     try {
-      console.error('[supervisor-daemon] uncaught', (e && (e as Error).stack) || e)
+      console.error(`[supervisor-daemon] ${kind}`, (e && (e as Error).stack) || e)
     } catch {
       /* */
     }
-  })
+    appendExitEvent({
+      ev: 'supervisor-uncaught',
+      identity: session,
+      kind,
+      reason: String((e as Error)?.stack ?? e).replace(/\s+/g, ' ').slice(0, 300),
+    })
+  }
+  process.on('uncaughtException', e => traceFault('exception', e))
+  process.on('unhandledRejection', e => traceFault('rejection', e))
 
   // ── boot-dialog driver (serving slice a) ────────────────────────────────────────
   // For a real runtime, answer the startup dialogs (codex trust/update/hooks, claude trust/resume)

package/src/tui/dashboard/data.ts

@@ -6,12 +6,12 @@
 // All paths resolve through the injected env → the same IAPEER_ROOT isolation as
 // every other side-effect (sandbox rule). Reads only — the dashboard mutates nothing.
 
-import { closeSync, openSync, readSync, statSync } from 'node:fs'
 import { join } from 'node:path'
 import { listPeers, type PeerListing } from '../../cli/index.ts'
 import { loadLifecycleConfig } from '../../lifecycle/index.ts'
 import { deliveryLogPath } from '../../daemon/deliverylog.ts'
 import { lifecycleLogPath } from '../../lifecycle/eventlog.ts'
+import { readLogTail } from '../../storage/rotatelog.ts'
 import { assemblePeerLog } from './model.ts'
 
 /** One peers snapshot (the poll unit). listPeers is synchronous and cheap: registry
@@ -42,26 +42,10 @@ export async function takeHostHeader(env: NodeJS.ProcessEnv): Promise<HostHeader
   }
 }
 
-/** Read the last `bytes` of a file without loading the whole log (delivery.log can
- *  be MBs before rotation). Missing/unreadable file → ''. */
-export function readTail(path: string, bytes = 64 * 1024): string {
-  try {
-    const size = statSync(path).size
-    const fd = openSync(path, 'r')
-    try {
-      const start = Math.max(0, size - bytes)
-      const buf = Buffer.alloc(size - start)
-      readSync(fd, buf, 0, buf.length, start)
-      // drop the leading partial line when we started mid-file
-      const s = buf.toString('utf8')
-      return start > 0 ? s.slice(s.indexOf('\n') + 1) : s
-    } finally {
-      closeSync(fd)
-    }
-  } catch {
-    return ''
-  }
-}
+/** Read the last `bytes` of a file without loading the whole log. Promoted to the
+ *  storage layer (readLogTail — the fleet-API replay reader shares it); kept as a
+ *  re-export so dashboard call sites/tests are untouched. */
+export const readTail: (path: string, bytes?: number) => string = readLogTail
 
 /** The per-peer log panel content: newest `limit` events concerning the peer from
  *  delivery.log + lifecycle.log (merged by timestamp). */

package/src/tui/dashboard/model.ts

@@ -8,6 +8,7 @@
 // under `bun test` with zero terminal plumbing.
 
 import type { PeerListing } from '../../cli/index.ts'
+import { eventConcernsPeer as concernsPeer, parseEventLine as parseLogfmtLine } from '../../storage/rotatelog.ts'
 
 // ─── row filtering ───────────────────────────────────────────────────────────
 
@@ -55,36 +56,22 @@ export interface LogEvent {
   fields: Record<string, string>
 }
 
-/** Parse one `ts=<iso> ev=<kind> k=v …` line; null for anything else (corrupt tail). */
+/** Parse one `ts=<iso> ev=<kind> k=v …` line; null for anything else (corrupt tail).
+ *  Delegates to the storage-layer QUOTE-AWARE parser (the writer's symmetric read
+ *  half) and adds the display time — the earlier display-only tokenizer split quoted
+ *  multi-word values (reason="idle 3700s") mid-value. */
 export function parseEventLine(line: string): LogEvent | null {
-  if (!line.startsWith('ts=')) return null
-  const fields: Record<string, string> = {}
-  // k=v tokens; values are token-atomic in our append format (no embedded spaces).
-  for (const tok of line.split(' ')) {
-    const i = tok.indexOf('=')
-    if (i > 0) fields[tok.slice(0, i)] = tok.slice(i + 1)
-  }
-  const ts = fields.ts
-  const ev = fields.ev
-  if (!ts || !ev) return null
-  const tsMs = Date.parse(ts)
-  if (!Number.isFinite(tsMs)) return null
-  const d = new Date(tsMs)
+  const p = parseLogfmtLine(line)
+  if (!p) return null
+  const d = new Date(p.tsMs)
   const pad = (n: number): string => String(n).padStart(2, '0')
-  return { tsMs, time: `${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`, ev, fields }
+  return { tsMs: p.tsMs, time: `${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`, ev: p.ev, fields: p.fields }
 }
 
 /** Does this event concern the peer? Matches bare personality and any `<rt>-<personality>`
- *  identity in the fields the two logs actually carry (to/caller/via/personality/identity). */
-export function eventConcernsPeer(e: LogEvent, personality: string): boolean {
-  const idSuffix = `-${personality}`
-  for (const key of ['to', 'caller', 'via', 'personality', 'identity', 'from', 'peer'] as const) {
-    const v = e.fields[key]
-    if (!v) continue
-    if (v === personality || v.endsWith(idSuffix)) return true
-  }
-  return false
-}
+ *  identity in the fields the two logs actually carry (to/caller/via/personality/identity).
+ *  Re-exported from the storage layer (the fleet peer-detail endpoint shares it). */
+export const eventConcernsPeer: (e: LogEvent, personality: string) => boolean = concernsPeer
 
 /** One display line per event — compact, the interesting fields only. */
 export function formatEvent(e: LogEvent): { text: string; tone: 'ok' | 'fail' | 'info' } {