@agfpd/iapeer 0.4.72 → 0.4.74

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.72",
+  "version": "0.4.74",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/launch/adapters/claude.ts

@@ -277,11 +277,15 @@ export const claudeAdapter: RuntimeAdapter = {
    *
    *   - '--dangerously-skip-permissions'  claude-start.sh:318, spawner.ts:776 —
    *     headless peer has no interactive owner to grant per-tool permission.
-   *   - '--disallowedTools','AskUserQuestion'  claude-start.sh:313/316,
-   *     spawner.ts:777 — AskUserQuestion would render in a TUI no headless peer
-   *     owner watches; the question goes "into the void". Default is the literal
-   *     'AskUserQuestion'; the per-peer override (PEER_DISALLOWED_TOOLS empty =
-   *     allow all) is install-time launch.env, not this path.
+   *   - '--disallowedTools', <list>  claude-start.sh:313/316, spawner.ts:777 —
+   *     AskUserQuestion would render in a TUI no headless peer owner watches; the
+   *     question goes "into the void", so it is disallowed by DEFAULT. The value is
+   *     an OPT-IN per-peer override via spec.disallowedTools (launch.env
+   *     PEER_DISALLOWED_TOOLS, merged in buildLaunchInvocation): UNDEFINED (the
+   *     fleet default) → the literal 'AskUserQuestion'; an EXPLICIT empty string →
+   *     the flag is OMITTED (allow all — e.g. to re-enable AskUserQuestion for a
+   *     throwaway peer); a non-empty value → that verbatim list. Only an explicitly
+   *     set env key changes behavior — the whole existing fleet is byte-identical.
    *   - '--add-dir','/'  grants the file/edit/bash tools access OUTSIDE cwd (the
    *     CLI equivalent of settings `permissions.additionalDirectories`). A peer
    *     reads/writes its memory vault (often an iCloud Obsidian dir) and ~/.iapeer,
@@ -314,11 +318,14 @@ export const claudeAdapter: RuntimeAdapter = {
     // active as a fail-SAFE backstop, and the separately-installed PreToolUse hook is
     // the primary interceptor (it fires regardless of mode — verified live 2.1.201).
     const gated = spec.approvalMode === 'gated'
+    // Opt-in disallowedTools (docs/17 — real-modal acceptance / general per-peer control). UNDEFINED →
+    // the hardcoded default 'AskUserQuestion' (fleet unchanged); explicit '' → omit the flag (allow all);
+    // a value → that verbatim list. A blank/whitespace value collapses to "omit" (the re-enable case).
+    const disallowed = (spec.disallowedTools === undefined ? 'AskUserQuestion' : spec.disallowedTools).trim()
     return [
       cfg.claudeBin,
       ...(gated ? ['--permission-mode', 'default'] : ['--dangerously-skip-permissions']),
-      '--disallowedTools',
-      'AskUserQuestion',
+      ...(disallowed ? ['--disallowedTools', disallowed] : []),
       '--add-dir',
       '/',
       ...(spec.systemPromptFile ? ['--system-prompt-file', spec.systemPromptFile] : []),

package/src/launch/adapters/modalDetect.ts

@@ -23,6 +23,23 @@ export interface NumberedModal {
 
 const CAP_LINES = 24
 const CAP_BYTES = 8192
+// How far above the footer to scan for the modal's options — the real AskUserQuestion box (question +
+// pill + N options each with a DESCRIPTION line + an inter-option separator) is a dozen-plus rows.
+const MODAL_MAX_LINES = 40
+
+/**
+ * Is `line` a claude/codex interactive-SELECT footer — the stable signature of a live numbered picker?
+ * AskUserQuestion: "Enter to select · ↑/↓ to navigate · Esc to cancel"; a resume/boot select: "Enter to
+ * confirm · Esc to cancel"; codex: "Press enter to confirm or esc to go back". Anchoring on this footer
+ * (boris's guidance — устойчивее чем «❯ внизу») is layout-robust: it survives the cursor sitting on ANY
+ * option and options being interleaved with description lines. The command-approval breaker's footer
+ * ("Esc to cancel · Tab to amend · ctrl+e to explain") deliberately does NOT match (no select/navigate
+ * hint) — it is a KNOWN class handled by its own taxonomy, and the structural guards below (a live
+ * glyph-selected option + ≥2 options + nothing below the footer) keep this from firing on prose.
+ */
+export function isSelectFooter(line: string): boolean {
+  return /esc to (?:cancel|go back)/i.test(line) && /(?:enter to |to navigate|to select|to confirm|press enter)/i.test(line)
+}
 // Unicode box-drawing block (U+2500–U+257F) — modal borders/separators; stripped for PARSING only
 // (the verbatim `content` keeps them).
 const BOX_DRAWING = /[─-╿]/g
@@ -65,37 +82,42 @@ function capBlock(block: string[]): string {
  */
 export function detectNumberedModal(pane: string, glyph: string): NumberedModal | null {
   const lines = pane.split(/\r?\n/)
-  // bottom-most row carrying the select glyph.
-  let selected = -1
-  for (let i = 0; i < lines.length; i++) if (lines[i].includes(glyph)) selected = i
-  if (selected < 0) return null
-  // it must be a SELECTED numbered option (`glyph … N. …`) — the composer (`glyph <text>`) carries no
-  // leading digit-dot, so an idle/ready pane and a mere quote-with-composer-below both fail here.
+  // 1. FOOTER anchor — the stable signature of a live interactive select (boris: устойчивее «❯ внизу»).
+  //    The LAST footer line is THIS modal's (a scrolled-off older one sits above). Anchoring here is
+  //    robust to the cursor sitting on ANY option and to options interleaved with DESCRIPTION lines /
+  //    separators (the real AskUserQuestion layout — verified against a live 2.1.202 render).
+  let footerIdx = -1
+  for (let i = 0; i < lines.length; i++) if (isSelectFooter(lines[i])) footerIdx = i
+  if (footerIdx < 0) return null
+  // 2. COMPOSER-REPLACED guard — a LIVE blocking modal has NOTHING below its footer (the composer is
+  //    gone). A mere QUOTE of a modal pasted into chat has the ready composer glyph rendered BELOW it, so
+  //    ANY select glyph after the footer means "not a live block" → reject (the В40 quote class).
+  for (let i = footerIdx + 1; i < lines.length; i++) if (lines[i].includes(glyph)) return null
+  // 3. OPTIONS — scan a bounded WINDOW above the footer (NOT a contiguous run: the real modal interleaves
+  //    each option with a wrapped description line and even an inter-option separator, and a blank can sit
+  //    between the last option and the footer). Require a glyph-SELECTED option (a live cursor is on one)
+  //    and ≥2 distinct numbered options. option1 = the "1." row CLOSEST to the footer (the modal's own —
+  //    a stray transcript "1." further up loses to it).
+  const windowTop = Math.max(0, footerIdx - MODAL_MAX_LINES)
   const selectedRe = new RegExp(`${escapeForRegex(glyph)}\\s*\\d+[.)]\\s`)
-  if (!selectedRe.test(lines[selected])) return null
-  // The select glyph sits only on the SELECTED option; siblings render WITHOUT it (above and below). Grow
-  // the contiguous OPTION RUN in BOTH directions from the selected row while each line parses as a
-  // numbered option (an interleaved blank / non-option line ends the run). This captures every option,
-  // not just the ones above the cursor.
-  let optTop = selected
-  let optBottom = selected
-  while (optTop - 1 >= 0 && parseOption(lines[optTop - 1], glyph)) optTop--
-  while (optBottom + 1 < lines.length && parseOption(lines[optBottom + 1], glyph)) optBottom++
-  // need ≥2 DISTINCT numbered options (a real select, not a lone printed `N.` line).
   const nums = new Set<number>()
   let option1 = ''
-  for (let i = optTop; i <= optBottom; i++) {
+  let hasSelected = false
+  let firstOptIdx = -1
+  for (let i = windowTop; i < footerIdx; i++) {
+    if (selectedRe.test(lines[i])) hasSelected = true
     const opt = parseOption(lines[i], glyph)
     if (!opt) continue
+    if (firstOptIdx < 0) firstOptIdx = i
     nums.add(opt.num)
-    if (opt.num === 1 && !option1) option1 = opt.label
+    if (opt.num === 1) option1 = opt.label // last (closest-to-footer) wins
   }
-  if (nums.size < 2) return null
-  // Verbatim block shown to the human: the option run + a little context (the question above / a footer
-  // below), then leading/trailing blank lines trimmed. Bounded by the caps.
-  const start = Math.max(0, optTop - 3)
-  const end = Math.min(lines.length - 1, optBottom + 2)
-  const block = lines.slice(start, end + 1)
+  if (!hasSelected) return null // no live cursor on an option → a printed list, not a live select
+  if (nums.size < 2) return null // ≥2 options → a real select
+  // 4. Verbatim block shown to the human: from a couple of lines above the first option (the question) to
+  //    the footer, blanks trimmed + capped.
+  const cTop = Math.max(windowTop, (firstOptIdx < 0 ? footerIdx : firstOptIdx) - 2)
+  const block = lines.slice(cTop, footerIdx + 1)
   while (block.length && block[0].trim() === '') block.shift()
   while (block.length && block[block.length - 1].trim() === '') block.pop()
   return { content: capBlock(block), option1: option1 || '(option 1)' }

package/src/launch/invocation.ts

@@ -34,10 +34,15 @@ export function buildLaunchInvocation(
 ): LaunchInvocation {
   const env = cfg.env ?? process.env
   const launchEnv = readLaunchEnv(spec.cwd, spec.runtime)
-  const specWithArgs: LaunchSpec =
-    launchEnv.startArgs.length > 0
-      ? { ...spec, extraArgs: [...(spec.extraArgs ?? []), ...launchEnv.startArgs] }
-      : spec
+  const specWithArgs: LaunchSpec = {
+    ...spec,
+    ...(launchEnv.startArgs.length > 0 ? { extraArgs: [...(spec.extraArgs ?? []), ...launchEnv.startArgs] } : {}),
+    // launch.env PEER_DISALLOWED_TOOLS opt-in — an explicit spec.disallowedTools (caller override) wins;
+    // else the launch.env value (undefined = key absent → adapter default, fleet unchanged).
+    ...(spec.disallowedTools === undefined && launchEnv.disallowedTools !== undefined
+      ? { disallowedTools: launchEnv.disallowedTools }
+      : {}),
+  }
   const argv = adapter.buildArgv(specWithArgs, cfg)
   const childEnv: NodeJS.ProcessEnv = {
     ...env,

package/src/launch/types.ts

@@ -159,6 +159,11 @@ export interface LaunchSpec {
   resumeRef?: string
   /** Free-form extra CLI args (PEER_START_ARGS). */
   extraArgs?: string[]
+  /** claude `--disallowedTools` value (opt-in per-peer override via launch.env `PEER_DISALLOWED_TOOLS`).
+   *  UNDEFINED (the default for the whole fleet) → the adapter's hardcoded default (`AskUserQuestion`);
+   *  an EXPLICIT empty string → the flag is OMITTED (allow all — e.g. re-enable AskUserQuestion); a
+   *  non-empty value → that verbatim list. Only claude's buildArgv consumes it (codex has no such flag). */
+  disallowedTools?: string
   /** Peer intelligence (artificial/natural/absent). Used to enforce an adapter's
    *  intelligence gate at launch (telegram allows natural|absent). Optional: a doctrine-
    *  less throwaway may omit it, but an adapter that declares allowedIntelligences

package/src/storage/index.ts

@@ -215,6 +215,11 @@ export function peerLaunchEnvPath(cwd: string, runtime: Runtime): string {
 export interface LaunchEnv {
   /** Tokens from PEER_START_ARGS, appended AFTER the adapter's base argv flags. */
   startArgs: string[]
+  /** claude `--disallowedTools` override from PEER_DISALLOWED_TOOLS. UNDEFINED = the key was ABSENT
+   *  (→ the adapter default is used, the whole fleet unchanged); a string (incl. '') = the key was
+   *  PRESENT (opt-in: '' omits the flag, a value sets it). The absent-vs-empty distinction is the
+   *  opt-in gate — only an explicitly-present key changes behavior. */
+  disallowedTools?: string
   /** Other KEY=VALUE assignments — extra child-process env for the peer session. */
   env: Record<string, string>
 }
@@ -255,8 +260,15 @@ export function readLaunchEnv(cwd: string, runtime: Runtime): LaunchEnv {
   }
   const startArgsRaw = (env.PEER_START_ARGS ?? '').trim()
   delete env.PEER_START_ARGS // consumed as argv, not propagated as a child env var
+  // PEER_DISALLOWED_TOOLS — a LAUNCH DIRECTIVE (claude --disallowedTools), not a child env var. Preserve
+  // the ABSENT (undefined → default) vs PRESENT-EMPTY ('' → omit the flag) distinction: an unset key must
+  // leave the whole fleet on the hardcoded default. Consumed out of the child env like PEER_START_ARGS.
+  const hasDisallowed = Object.prototype.hasOwnProperty.call(env, 'PEER_DISALLOWED_TOOLS')
+  const disallowedTools = hasDisallowed ? env.PEER_DISALLOWED_TOOLS : undefined
+  delete env.PEER_DISALLOWED_TOOLS
   return {
     startArgs: startArgsRaw ? startArgsRaw.split(/\s+/) : [],
+    ...(disallowedTools !== undefined ? { disallowedTools } : {}),
     env,
   }
 }