@agfpd/iapeer 0.4.7 → 0.4.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.7",
+  "version": "0.4.9",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -50,7 +50,7 @@ import {
   type WakeResult,
 } from '../lifecycle/index.ts'
 import { getAdapter } from '../launch/index.ts'
-import { hostRunDir, hostSessionAlive } from '../launch/ptyHost.ts' // spawn-flip Ф0b-3: host-aware attach
+import { hostRunDir } from '../launch/ptyHost.ts' // pty-only: attach via the supervisor client
 import { runSupervisorClient } from '../supervisor/client.ts' // @xterm-free attach client (both reattach port-deps baked in)
 import { cycleDaemon, isFoundationOwnedPlist, launchctlBootstrap, launchdLabel, launchdPlistPath } from '../launch/launchd.ts'
 import { readPeerProfile, resolveCallerIdentity, resolveIdentity, writePeerProfileAtomic } from '../identity/index.ts'
@@ -1025,12 +1025,6 @@ const VERBS: ReadonlyArray<{ sig: string; desc: string }> = [
   { sig: 'self-done', desc: '(agent self-call, ephemeral) silent finish: arm own quiet-reap, wake no one' },
   { sig: 'native-memory <off|on> (--peer <p> | --all)', desc: "gate/restore runtimes' native memory (canonized lever; контракт «Слот памяти»)" },
   { sig: 'trust-hooks <hooks.json> [--check]', desc: 'pre-seed codex hooks trust for a file-form hooks.json (no modal); --check = drift report' },
-  {
-    sig: 'shadow [--once | --minutes <m>] [--interval <ms>]',
-    desc: 'READ-ONLY tmux→pty fidelity observer (migration burn-in): compares pty-model verdicts vs live tmux on the warm fleet → ~/.iapeer/logs/iapeer/shadow-fidelity.json. Never delivers/mutates.',
-  },
-  { sig: 'shadow-install', desc: 'install + load the always-on shadow burn-in launchd job (com.iapeer.shadow-fidelity); idempotent, re-cycled by update/rollback' },
-  { sig: 'shadow-uninstall', desc: 'bootout + remove the shadow burn-in launchd job (the correct way to stop it; STOP file is respawned past by KeepAlive)' },
   {
     sig: 'supervisor up|start|attach|list|kill <sess> [runtime]',
     desc: 'DARK (cutover Block 2): detach-persistent pty-supervisor PoC port; serves nothing on the live fleet (throwaway validation only)',
@@ -2122,54 +2116,6 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         const attachCfg = loadLifecycleConfig(env)
         return await attachIntoSession(r.identity, r.socketPath, env, attachCfg.eventLogDir, r.woke)
       }
-      case 'shadow': {
-        // Read-only fidelity OBSERVER for the tmux→pty migration burn-in (track «b»). Compares
-        // the pty-model verdicts (occupancy/ready-gate/liveness) vs live tmux verdicts on the
-        // warm fleet, logs to <eventLogDir>/shadow-fidelity.{jsonl,json}. STRICTLY read-only —
-        // nothing in delivery/lifecycle imports the shadow module; the dynamic import keeps
-        // @xterm OUT of the hot path (the daemon never loads it). --once | --minutes <m> |
-        // --interval <ms>; stop a long run with `touch <eventLogDir>/shadow-fidelity.STOP`.
-        const cfg = loadLifecycleConfig(env)
-        const { runShadowFidelity } = await import('../shadow/index.ts')
-        await runShadowFidelity({
-          logDir: cfg.logDir,
-          eventLogDir: cfg.eventLogDir,
-          sockDir: cfg.sockDir,
-          intervalMs: flags.interval ? Number(flags.interval) : 5000,
-          maxMinutes: flags.minutes ? Number(flags.minutes) : 0,
-          once: flags.once === true,
-          log: errOut,
-        })
-        out(`shadow-fidelity → ${cfg.eventLogDir}/shadow-fidelity.json\n`)
-        return 0
-      }
-      case 'shadow-install': {
-        // Code-managed install of the always-on shadow burn-in launchd job
-        // (com.iapeer.shadow-fidelity) — reproducible, ownership-sentinel-guarded, and
-        // re-cycled automatically by `iapeer update` / `rollback`. Replaces a hand-written
-        // plist. Idempotent (no-op on an unchanged, loaded job). install.ts carries NO @xterm
-        // — dynamic-imported anyway to keep the CLI's common path light.
-        const { installShadowJob } = await import('../shadow/install.ts')
-        const r = installShadowJob(env)
-        if (r.action === 'failed' || r.action === 'refused-foreign') {
-          errOut(`shadow-install: ${r.action}${r.detail ? ` — ${r.detail}` : ''}\n  plist: ${r.path}\n`)
-          return 1
-        }
-        out(`shadow burn-in job ${r.action} (plist ${r.changed ? 'written' : 'unchanged'}): ${r.path}\n`)
-        return 0
-      }
-      case 'shadow-uninstall': {
-        // Stop + remove the burn-in job (bootout + rm) — the CORRECT halt (KeepAlive would
-        // respawn past the STOP sentinel). Refuses a non-foundation plist (ownership guard).
-        const { uninstallShadowJob } = await import('../shadow/install.ts')
-        const r = uninstallShadowJob(env)
-        if (r.action === 'failed' || r.action === 'refused-foreign') {
-          errOut(`shadow-uninstall: ${r.action}${r.detail ? ` — ${r.detail}` : ''}\n  plist: ${r.path}\n`)
-          return 1
-        }
-        out(`shadow burn-in job ${r.action}: ${r.path}\n`)
-        return 0
-      }
       case 'supervisor': {
         // DARK (cutover Block 2): the detach-persistent pty-supervisor (PoC pts.mjs port). NOT
         // wired into delivery/launch — it serves NOTHING on the live fleet; it is validated on
@@ -2261,38 +2207,25 @@ function defaultFromIdentity(env: NodeJS.ProcessEnv): string {
 }
 
 /** Drop the operator into a live peer session — the interactive open shared by `attach` (resume)
- *  and a TTY `iapeer <runtime>` (fresh launch). A supervisor-HOSTED session has no tmux to attach,
- *  so the operator is handed to the supervisor client (raw passthrough + repaint-on-attach + Ctrl-]
- *  detach); otherwise `tmux attach`. The operator window is bracketed in lifecycle.log
- *  (ev=attach … ev=attach-end) so a death timestamp inside the window reads directly off the log.
- *  Returns the client exit code. */
+ *  and a TTY `iapeer <runtime>` (fresh launch). pty-only: the operator is handed to the supervisor
+ *  client (raw passthrough + repaint-on-attach + Ctrl-] detach). The operator window is bracketed in
+ *  lifecycle.log (ev=attach … ev=attach-end) so a death timestamp inside the window reads directly off
+ *  the log. Returns the client exit code. (`_socketPath` retained for call-site compatibility.) */
 async function attachIntoSession(
   identity: string,
-  socketPath: string,
+  _socketPath: string,
   env: NodeJS.ProcessEnv,
   eventLogDir: string,
   woke: boolean,
 ): Promise<number> {
   appendLifecycleEvent(eventLogDir, { ev: 'attach', identity, woke: String(woke) }, { env })
-  if (hostSessionAlive(identity)) {
-    // runSupervisorClient calls process.exit on every terminal path → bracket attach-end via an
-    // exit hook (appendFileSync is signal/exit-safe).
-    process.on('exit', () =>
-      appendLifecycleEvent(eventLogDir, { ev: 'attach-end', identity, rc: process.exitCode ?? 0 }, { env }),
-    )
-    await runSupervisorClient(hostRunDir(), identity)
-    return 0 // unreachable — runSupervisorClient exits on detach / session end
-  }
-  // `env -u TMUX` so a nested attach from inside tmux does not error ("sessions should be nested
-  // with care").
-  const attachEnv = { ...env }
-  delete attachEnv.TMUX
-  const a = spawnSync('tmux', ['-S', socketPath, 'attach', '-t', identity], {
-    stdio: 'inherit',
-    env: attachEnv as Record<string, string>,
-  })
-  appendLifecycleEvent(eventLogDir, { ev: 'attach-end', identity, rc: a.status ?? -1 }, { env })
-  return a.status ?? 0
+  // runSupervisorClient calls process.exit on every terminal path → bracket attach-end via an exit
+  // hook (appendFileSync is signal/exit-safe).
+  process.on('exit', () =>
+    appendLifecycleEvent(eventLogDir, { ev: 'attach-end', identity, rc: process.exitCode ?? 0 }, { env }),
+  )
+  await runSupervisorClient(hostRunDir(), identity)
+  return 0 // unreachable — runSupervisorClient exits on detach / session end
 }
 
 if (import.meta.main) {

package/src/cli/listTui.ts

@@ -7,9 +7,8 @@
 // raw-mode terminal I/O, and on ENTER it hands off to attachPeer + tmux attach — the
 // same ensure-live+resume path the `attach` verb uses (so a live session is never torn).
 
-import { spawnSync } from 'child_process'
 import { attachPeer } from '../lifecycle/index.ts'
-import { hostRunDir, hostSessionAlive } from '../launch/ptyHost.ts' // spawn-flip Ф0b-3: host-aware attach
+import { hostRunDir } from '../launch/ptyHost.ts' // pty-only: attach via the supervisor client
 import { runSupervisorClient } from '../supervisor/client.ts'
 import { listPeers, type PeerListing } from './index.ts'
 
@@ -140,18 +139,9 @@ export async function runListTui(env: NodeJS.ProcessEnv = process.env): Promise<
           return 1
         }
         stdout.write(`${r.woke ? 'woke + ' : ''}attaching ${r.identity}…\n`)
-        // SPAWN-FLIP Ф0b-3: a supervisor-HOSTED session attaches via the supervisor client (no tmux).
-        if (hostSessionAlive(r.identity)) {
-          await runSupervisorClient(hostRunDir(), r.identity)
-          return 0 // unreachable — runSupervisorClient exits on detach / session end
-        }
-        const attachEnv = { ...env }
-        delete attachEnv.TMUX
-        const a = spawnSync('tmux', ['-S', r.socketPath, 'attach', '-t', r.identity], {
-          stdio: 'inherit',
-          env: attachEnv as Record<string, string>,
-        })
-        return a.status ?? 0
+        // pty-only: attach via the supervisor client (no tmux).
+        await runSupervisorClient(hostRunDir(), r.identity)
+        return 0 // unreachable — runSupervisorClient exits on detach / session end
       }
     }
   } finally {

package/src/launch/cmdlog.ts

@@ -1,43 +1,12 @@
-// tmux command-log — the SOCKET-COMMAND observability layer of the killer hunt.
-//
-// Why (a session-death class): a tmux server killed by a
-// CLIENT COMMAND (`kill-server` / `kill-session` over the unix socket) dies with
-// zero signals — structurally invisible to ALL THREE existing layers: the eslogger
-// trap (no kill(2) anywhere; kernel-originated SIGHUP to the panes is also proven
-// invisible), the pane-died hook (kill-session destroys the pane without retention)
-// and the server-death canary (sees only "server gone"). The tmux server's OWN
-// verbose log is the only witness of that layer: started with `-v`, the server
-// appends `message: client-<pid> command: <verb> <args>` for every client command —
-// the attribution (client pid + exact command + timestamp) that decides the class
-// binarily: "killed by client X" vs "no command ⇒ internal exit".
-//
-// Sensitivity: the -v log carries FULL send-keys payloads
-// (every delivered envelope, plaintext) — tmux has no commands-only level and the
-// server writes the file itself (name tmux-server-<pid>.log in the STARTING
-// client's cwd — no FIFO/pipe interposition possible). Containment instead:
-//   • the per-identity dir is 0700 (others cannot traverse — same protection class
-//     as the transcripts that already hold the same texts);
-//   • files are chmod'ed 0600 right after the server starts (hardenCmdLogDir);
-//   • volume is capped: ~7 KB/s under a 10 fps TUI redraw (measured) — the
-//     supervise tick tail-keeps each log over CAP_BYTES down to KEEP_BYTES.
-//     tmux writes with O_APPEND (proven live: external truncation is safe, the
-//     server keeps appending at the new EOF), and a killer's command is by nature
-//     the LAST thing in the log — the death tail always survives capping.
-//   • scope: agent-runtime (warm) sessions only — always-on infra sessions relaunch
-//     rarely (no rotation point) and are not the dying class.
-// Rotation: prepareCmdLogDir WIPES the identity dir on every launch — one server
-// generation per dir, no unbounded accumulation across relaunches.
-//
-// Best-effort BY CONSTRUCTION: observability must never fail a launch or a
-// supervise tick — every export swallows FS errors.
+// Pane-log volume cap — tail-keep the per-identity pane-logs (<logDir>/<identity>.log), the RAW child
+// pty byte stream the supervisor appends for a session's whole life. Unlike the lifecycle/delivery logs
+// (their own size-rotation under logs/iapeer), the pane-log had NO bound and grew to hundreds of MB per
+// warm peer on an always-on host; the supervise tick caps it here. Best-effort BY CONSTRUCTION: a cap
+// must never fail a supervise tick — every export swallows FS errors.
 
-import { chmodSync, mkdirSync, openSync, closeSync, readSync, readdirSync, rmSync, statSync, writeFileSync, fstatSync } from 'fs'
+import { openSync, closeSync, readSync, readdirSync, statSync, writeFileSync, fstatSync } from 'fs'
 import { join } from 'path'
 
-/** Tail-keep cap: a log over CAP_BYTES is cut down to its last KEEP_BYTES. */
-export const CMDLOG_CAP_BYTES = 8 * 1024 * 1024
-export const CMDLOG_KEEP_BYTES = 1024 * 1024
-
 /** Pane-log tail-keep cap (capPaneLogs): a per-identity pane-log over CAP is cut to
  *  its last KEEP. KEEP_BYTES INVARIANT — must stay ≥ the pane-log reader's seed
  *  window (readyGateModel SEED_BYTES = 4 MiB, the tail fed into the headless xterm
@@ -46,48 +15,8 @@ export const CMDLOG_KEEP_BYTES = 1024 * 1024
 export const PANELOG_CAP_BYTES = 32 * 1024 * 1024
 export const PANELOG_KEEP_BYTES = 8 * 1024 * 1024
 
-const CMDLOG_SUBDIR = 'tmux-cmdlog'
-
-/** The per-identity command-log dir: <eventLogDir>/tmux-cmdlog/<identity>. The
- *  session-creating tmux client runs FROM this dir with `-v`, so the server drops
- *  tmux-server-<pid>.log (and the client its tmux-client-*.log) here. */
-export function cmdLogDirFor(eventLogDir: string, identity: string): string {
-  return join(eventLogDir, CMDLOG_SUBDIR, identity)
-}
-
-/** Wipe + recreate the identity's command-log dir (0700) for a fresh server
- *  generation. Returns the dir, or undefined when the FS refuses (the caller then
- *  launches WITHOUT -v — observability is never load-bearing). */
-export function prepareCmdLogDir(eventLogDir: string, identity: string): string | undefined {
-  try {
-    const dir = cmdLogDirFor(eventLogDir, identity)
-    rmSync(dir, { recursive: true, force: true })
-    mkdirSync(dir, { recursive: true, mode: 0o700 })
-    return dir
-  } catch {
-    return undefined
-  }
-}
-
-/** Clamp every file the freshly-started server/client dropped into the dir to
- *  0600 (the dir's 0700 already blocks traversal; this is the belt to that
- *  suspender — the acceptance criterion: no file wider than 0600). */
-export function hardenCmdLogDir(dir: string): void {
-  try {
-    for (const name of readdirSync(dir)) {
-      try {
-        chmodSync(join(dir, name), 0o600)
-      } catch {
-        /* per-file best-effort */
-      }
-    }
-  } catch {
-    /* dir gone — nothing to harden */
-  }
-}
-
 /** Tail-keep ONE file: if it exceeds capBytes, rewrite it as its last keepBytes.
- *  Safe against a live O_APPEND writer (tmux `cat >>`, the supervisor append-fd):
+ *  Safe against a live O_APPEND writer (the supervisor append-fd):
  *  the next write lands at the new EOF (proven by live truncation test). Lines
  *  appended between the tail-read and the rewrite are lost — acceptable mid-life
  *  noise. Returns true iff the file was capped. Best-effort: swallows FS errors. */
@@ -111,38 +40,6 @@ function tailKeepFile(path: string, capBytes: number, keepBytes: number): boolea
   }
 }
 
-/** Tail-keep cap over every command log under <eventLogDir>/tmux-cmdlog/<identity>.
- *  A file over capBytes is rewritten as its last keepBytes. The death tail is never
- *  here because the peer is alive while being capped. */
-export function capCmdLogs(
-  eventLogDir: string,
-  capBytes: number = CMDLOG_CAP_BYTES,
-  keepBytes: number = CMDLOG_KEEP_BYTES,
-): string[] {
-  const capped: string[] = []
-  let identities: string[]
-  try {
-    identities = readdirSync(join(eventLogDir, CMDLOG_SUBDIR))
-  } catch {
-    return capped
-  }
-  for (const identity of identities) {
-    const dir = join(eventLogDir, CMDLOG_SUBDIR, identity)
-    let files: string[]
-    try {
-      files = readdirSync(dir)
-    } catch {
-      continue
-    }
-    for (const name of files) {
-      if (!name.endsWith('.log')) continue
-      const path = join(dir, name)
-      if (tailKeepFile(path, capBytes, keepBytes)) capped.push(path)
-    }
-  }
-  return capped
-}
-
 /** Tail-keep cap over the per-identity PANE-LOGS (<logDir>/<identity>.log) — the RAW
  *  TUI byte stream that pipe-pane (tmux) / the supervisor append for a session's whole
  *  life. Unlike the lifecycle/delivery logs (their own size-rotation under logs/iapeer),