@agfpd/iapeer 0.4.73 → 0.4.75

package/README.md

@@ -107,6 +107,8 @@ What this means for you:
 - You are trusting the model's judgment, and the doctrine you give each peer, the same way you would trust a developer with a shell on your account.
 - iapeer does **not** silently weaken your own interactive `claude` / `codex` setup. The bypass acceptance is recorded per peer, in that agent's own config; the project-MCP pre-approval is written **project-locally**, under the peer's folder — never to your global user settings.
 
+**Want a human in the loop for a given peer?** Set its approval mode to `gated` — `iapeer approval-mode <peer> gated`. That peer launches **without** the bypass flag, and every blocking approval its runtime would raise is routed to you — a Telegram button, a click in the tray, or `iapeer approve` on the CLI — before the tool runs; your `allow`/`deny` (with a reason) flows back and the tool proceeds or is refused. The default stays `yolo` (bypass) for every peer; `gated` is opt-in, per peer. See [docs/17 — Human approval](docs/17-approval.md).
+
 Run iapeer on a host you control, give each peer only the access it needs, and treat a peer's instructions as security-relevant. `iapeer onboard` states this at setup; it's repeated here so the trade-off is explicit before you create your first agent. Details on every first-run dialog: [docs/07 — Install & update](docs/07-install-and-update.md#first-run-dialogs-on-a-clean-machine).
 
 ## Documentation
@@ -121,8 +123,6 @@ Planned, not yet built:
 - **Linux support** — iapeer runs on macOS today; Linux is planned.
 - **More agent runtimes** — `opencode` and `antigravity`, two further CLI runtimes alongside Claude Code and Codex.
 - **Discord runtime** — a human-presence runtime for Discord, alongside Telegram.
-- **Permissions gate** — finer control over what an agent is allowed to do.
-- **Approve permissions over Telegram** — approve an agent's permission requests from the chat; today permissions are auto-allowed by flags.
 
 ## License
 

package/docs/16-tray.md

@@ -24,11 +24,16 @@ activation that also installs SwiftBar.app when it is absent.
   daemon any other way; the built-in TUI keeps its direct read path for that case, see
   [15](15-fleet-api.md)).
 - **Dropdown:** a host header (`iapeer <version> · up <uptime>`) and the memory/voice
-  provider heartbeats, then one row per peer:
+  provider heartbeats, then one row per peer, in **two groups**: the `🔒` **launchd block**
+  (the human channel + service infra — non-clickable status rows) is pulled to the **top as
+  one contiguous block, before the first working agent**, regardless of live/asleep — so the
+  bar separates "service, don't touch" from the working agents at a glance. Working agents
+  follow. Within **each** group the order is live → asleep → stopped, then alphabetical.
   - `<peer>  <runtime><glyph> …  <age>` with the same glyph semantics as the CLI —
     `●` live · `○` asleep · `✕` stopped — green when any runtime is live. Badges: `👤`
-    a human is attached, `🔒` launchd-managed (H4 read-only), `⏳N` an ephemeral peer's
-    queue depth.
+    a human is attached, `🔒` launchd-managed (H4 read-only), `🛡` the peer runs in **gated**
+    human-approval mode (docs/17; `yolo` is the fleet default and carries no badge — a bare
+    row reads as yolo), `⏳N` an ephemeral peer's queue depth.
   - **Click an agent peer → Terminal.app running `iapeer attach <peer>`.** The row itself is
     the attach action (no submenu, so a click attaches rather than merely expanding). The
     handoff goes through `iapeer tray attach-term`, which writes a per-peer `.command`

package/docs/ru/16-tray.md

@@ -22,11 +22,16 @@ SwiftBar.app, если его нет.
   покажет сломанный демон — встроенный TUI держит прямой путь чтения для этого случая, см.
   [15](15-fleet-api.md)).
 - **Выпадашка:** шапка хоста (`iapeer <версия> · up <аптайм>`) и хартбиты провайдеров памяти
-  и голоса, затем строка на пира:
+  и голоса, затем строка на пира, **двумя группами**: блок `🔒` **под launchd** (человеческий
+  канал + служебная инфра — некликабельные статус-строки) вынесен **наверх единым непрерывным
+  блоком, перед первым рабочим агентом**, независимо от live/asleep — так бар с одного взгляда
+  отделяет «служебное, не трогать» от рабочих агентов. Рабочие агенты идут следом. Внутри
+  **каждой** группы порядок: живой → спит → остановлен, затем по алфавиту.
   - `<peer>  <рантайм><глиф> …  <возраст>` с той же семантикой глифов, что в CLI —
     `●` живой · `○` спит · `✕` остановлен — зелёный, если хоть один рантайм живой. Бейджи:
-    `👤` подключён человек, `🔒` под launchd (H4 read-only), `⏳N` глубина очереди эфемерного
-    пира.
+    `👤` подключён человек, `🔒` под launchd (H4 read-only), `🛡` пир в режиме **gated**
+    human-approval (docs/17; `yolo` — дефолт флота, без бейджа: голая строка читается как yolo),
+    `⏳N` глубина очереди эфемерного пира.
   - **Клик по агент-пиру → Terminal.app с `iapeer attach <peer>`.** Строка сама и есть действие
     attach (без подменю — клик аттачит, а не раскрывает). Передача идёт через `iapeer tray
     attach-term`: пишет per-peer `.command`-лаунчер и `open`'ит его — `open <файл>.command`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.73",
+  "version": "0.4.75",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/launch/adapters/modalDetect.ts

@@ -23,6 +23,23 @@ export interface NumberedModal {
 
 const CAP_LINES = 24
 const CAP_BYTES = 8192
+// How far above the footer to scan for the modal's options — the real AskUserQuestion box (question +
+// pill + N options each with a DESCRIPTION line + an inter-option separator) is a dozen-plus rows.
+const MODAL_MAX_LINES = 40
+
+/**
+ * Is `line` a claude/codex interactive-SELECT footer — the stable signature of a live numbered picker?
+ * AskUserQuestion: "Enter to select · ↑/↓ to navigate · Esc to cancel"; a resume/boot select: "Enter to
+ * confirm · Esc to cancel"; codex: "Press enter to confirm or esc to go back". Anchoring on this footer
+ * (boris's guidance — устойчивее чем «❯ внизу») is layout-robust: it survives the cursor sitting on ANY
+ * option and options being interleaved with description lines. The command-approval breaker's footer
+ * ("Esc to cancel · Tab to amend · ctrl+e to explain") deliberately does NOT match (no select/navigate
+ * hint) — it is a KNOWN class handled by its own taxonomy, and the structural guards below (a live
+ * glyph-selected option + ≥2 options + nothing below the footer) keep this from firing on prose.
+ */
+export function isSelectFooter(line: string): boolean {
+  return /esc to (?:cancel|go back)/i.test(line) && /(?:enter to |to navigate|to select|to confirm|press enter)/i.test(line)
+}
 // Unicode box-drawing block (U+2500–U+257F) — modal borders/separators; stripped for PARSING only
 // (the verbatim `content` keeps them).
 const BOX_DRAWING = /[─-╿]/g
@@ -65,37 +82,42 @@ function capBlock(block: string[]): string {
  */
 export function detectNumberedModal(pane: string, glyph: string): NumberedModal | null {
   const lines = pane.split(/\r?\n/)
-  // bottom-most row carrying the select glyph.
-  let selected = -1
-  for (let i = 0; i < lines.length; i++) if (lines[i].includes(glyph)) selected = i
-  if (selected < 0) return null
-  // it must be a SELECTED numbered option (`glyph … N. …`) — the composer (`glyph <text>`) carries no
-  // leading digit-dot, so an idle/ready pane and a mere quote-with-composer-below both fail here.
+  // 1. FOOTER anchor — the stable signature of a live interactive select (boris: устойчивее «❯ внизу»).
+  //    The LAST footer line is THIS modal's (a scrolled-off older one sits above). Anchoring here is
+  //    robust to the cursor sitting on ANY option and to options interleaved with DESCRIPTION lines /
+  //    separators (the real AskUserQuestion layout — verified against a live 2.1.202 render).
+  let footerIdx = -1
+  for (let i = 0; i < lines.length; i++) if (isSelectFooter(lines[i])) footerIdx = i
+  if (footerIdx < 0) return null
+  // 2. COMPOSER-REPLACED guard — a LIVE blocking modal has NOTHING below its footer (the composer is
+  //    gone). A mere QUOTE of a modal pasted into chat has the ready composer glyph rendered BELOW it, so
+  //    ANY select glyph after the footer means "not a live block" → reject (the В40 quote class).
+  for (let i = footerIdx + 1; i < lines.length; i++) if (lines[i].includes(glyph)) return null
+  // 3. OPTIONS — scan a bounded WINDOW above the footer (NOT a contiguous run: the real modal interleaves
+  //    each option with a wrapped description line and even an inter-option separator, and a blank can sit
+  //    between the last option and the footer). Require a glyph-SELECTED option (a live cursor is on one)
+  //    and ≥2 distinct numbered options. option1 = the "1." row CLOSEST to the footer (the modal's own —
+  //    a stray transcript "1." further up loses to it).
+  const windowTop = Math.max(0, footerIdx - MODAL_MAX_LINES)
   const selectedRe = new RegExp(`${escapeForRegex(glyph)}\\s*\\d+[.)]\\s`)
-  if (!selectedRe.test(lines[selected])) return null
-  // The select glyph sits only on the SELECTED option; siblings render WITHOUT it (above and below). Grow
-  // the contiguous OPTION RUN in BOTH directions from the selected row while each line parses as a
-  // numbered option (an interleaved blank / non-option line ends the run). This captures every option,
-  // not just the ones above the cursor.
-  let optTop = selected
-  let optBottom = selected
-  while (optTop - 1 >= 0 && parseOption(lines[optTop - 1], glyph)) optTop--
-  while (optBottom + 1 < lines.length && parseOption(lines[optBottom + 1], glyph)) optBottom++
-  // need ≥2 DISTINCT numbered options (a real select, not a lone printed `N.` line).
   const nums = new Set<number>()
   let option1 = ''
-  for (let i = optTop; i <= optBottom; i++) {
+  let hasSelected = false
+  let firstOptIdx = -1
+  for (let i = windowTop; i < footerIdx; i++) {
+    if (selectedRe.test(lines[i])) hasSelected = true
     const opt = parseOption(lines[i], glyph)
     if (!opt) continue
+    if (firstOptIdx < 0) firstOptIdx = i
     nums.add(opt.num)
-    if (opt.num === 1 && !option1) option1 = opt.label
+    if (opt.num === 1) option1 = opt.label // last (closest-to-footer) wins
   }
-  if (nums.size < 2) return null
-  // Verbatim block shown to the human: the option run + a little context (the question above / a footer
-  // below), then leading/trailing blank lines trimmed. Bounded by the caps.
-  const start = Math.max(0, optTop - 3)
-  const end = Math.min(lines.length - 1, optBottom + 2)
-  const block = lines.slice(start, end + 1)
+  if (!hasSelected) return null // no live cursor on an option → a printed list, not a live select
+  if (nums.size < 2) return null // ≥2 options → a real select
+  // 4. Verbatim block shown to the human: from a couple of lines above the first option (the question) to
+  //    the footer, blanks trimmed + capped.
+  const cTop = Math.max(windowTop, (firstOptIdx < 0 ? footerIdx : firstOptIdx) - 2)
+  const block = lines.slice(cTop, footerIdx + 1)
   while (block.length && block[0].trim() === '') block.shift()
   while (block.length && block[block.length - 1].trim() === '') block.pop()
   return { content: capBlock(block), option1: option1 || '(option 1)' }

package/src/launch/index.ts

@@ -122,6 +122,24 @@ export function exitLogPath(exitLogDir: string): string {
 // launch — bring up ONE session (runtime-agnostic via the adapter)
 // ─────────────────────────────────────────────────────────────────────────────
 
+/**
+ * The intelligence gate — launch step (0), extracted as a PURE predicate so it is
+ * unit-testable in isolation (no bring-up, never touches the pty host). A channel
+ * adapter that declares `allowedIntelligences` (telegram/voicetalk → ['natural',
+ * 'absent']) refuses a peer whose nature is NOT in the set — and refuses too when
+ * the nature is unknown (cannot confirm). Returns the fail-loud reason string, or
+ * `null` when the gate PASSES (the peer may proceed to bring-up).
+ */
+export function intelligenceGateReason(adapter: RuntimeAdapter, spec: LaunchSpec): string | null {
+  if (adapter.allowedIntelligences && (spec.intelligence == null || !adapter.allowedIntelligences.includes(spec.intelligence))) {
+    return (
+      `runtime "${spec.runtime}" requires intelligence ∈ {${adapter.allowedIntelligences.join(', ')}}, ` +
+      `peer "${spec.personality}" is ${spec.intelligence ?? 'unknown'} — refusing to launch`
+    )
+  }
+  return null
+}
+
 export const launch: LaunchFn = async (
   spec: LaunchSpec,
   adapter: RuntimeAdapter,
@@ -137,13 +155,8 @@ export const launch: LaunchFn = async (
   //     A channel runtime carries a human (natural) OR a faceless service bot (absent), never an
   //     LLM agent (artificial). Ports the persistent-peer FATAL human-channel guard, relaxed to
   //     first-class faceless service bots (docs/Рантайм-адаптеры).
-  if (adapter.allowedIntelligences && (spec.intelligence == null || !adapter.allowedIntelligences.includes(spec.intelligence))) {
-    return fail(
-      identity,
-      `runtime "${spec.runtime}" requires intelligence ∈ {${adapter.allowedIntelligences.join(', ')}}, ` +
-        `peer "${spec.personality}" is ${spec.intelligence ?? 'unknown'} — refusing to launch`,
-    )
-  }
+  const gateReason = intelligenceGateReason(adapter, spec)
+  if (gateReason) return fail(identity, gateReason)
 
   // (0.5) Ensure the socket's PARENT dir exists before `tmux new-session -S <sock>` —
   //       tmux does NOT create it and fails SILENTLY (the session "dies immediately")

package/src/tray/render.ts

@@ -43,6 +43,8 @@ export interface TrayPeer {
   last_active_ms?: number
   attached?: boolean
   launchd_managed?: boolean
+  /** Human-approval mode (docs/17). ABSENT ⇒ `yolo` (client obligation — a pre-approval daemon omits it). */
+  approval_mode?: 'yolo' | 'gated'
   wake_policy?: 'warm' | 'ephemeral'
   queue_depth?: number
 }
@@ -133,6 +135,12 @@ function aggregate(p: TrayPeer): 'live' | 'asleep' | 'stopped' {
 
 const RANK: Record<'live' | 'asleep' | 'stopped', number> = { live: 0, asleep: 1, stopped: 2 }
 
+// 🔒 launchd-managed peers (the human channel + service infra — arthur/timer/watcher) are
+// NON-clickable status rows. They form ONE contiguous block at the very TOP, before the first
+// working agent, regardless of live/asleep — so the bar separates "service, don't touch" from the
+// working agents at a glance (owner UX). `attachable` (= !launchd_managed) is the same predicate.
+const lockRank = (p: TrayPeer): number => (p.launchd_managed ? 0 : 1)
+
 // ── renderers ─────────────────────────────────────────────────────────────────
 
 const MANAGE_COMMANDS: Array<{ cmd: string; label: string }> = [
@@ -150,6 +158,10 @@ export function renderSwiftBar(snapshot: TraySnapshot, opts: RenderOptions): str
   const now = opts.now ?? Date.now()
   const bin = opts.binPath
   const peers = [...snapshot.peers].sort((a, b) => {
+    // primary: the 🔒 lock block first (service/human infra), working agents below
+    const l = lockRank(a) - lockRank(b)
+    if (l !== 0) return l
+    // secondary (within EACH block): the existing live→asleep→stopped, then alpha
     const r = RANK[aggregate(a)] - RANK[aggregate(b)]
     return r !== 0 ? r : a.personality.localeCompare(b.personality)
   })
@@ -241,9 +253,14 @@ function attachable(p: TrayPeer): boolean {
 function renderPeerRow(p: TrayPeer, bin: string, now: number, pendingCount = 0): string {
   const agg = aggregate(p)
   const detail = p.runtimes.map(r => `${r.runtime}${GLYPH[r.status]}`).join(' ')
+  // approval mode (docs/17): the whole fleet defaults to `yolo`, so showing it on every row is
+  // noise — mark ONLY the exception, `gated` (this peer's blocking approvals go to a human), with a
+  // 🛡 shield. No badge ⇒ yolo (the default; also how a pre-approval snapshot with the field absent
+  // renders). So the row reads the mode: 🛡 = gated, bare = yolo.
   const badges =
     (p.attached ? ' 👤' : '') +
     (p.launchd_managed ? ' 🔒' : '') +
+    (p.approval_mode === 'gated' ? ' 🛡' : '') +
     (p.wake_policy === 'ephemeral' && (p.queue_depth ?? 0) > 0 ? ` ⏳${p.queue_depth}` : '')
   const ageStr = p.last_active_ms ? `  ${fmtAge(p.last_active_ms, now)}` : ''
   // HIGHLIGHT a peer with a pending approval: a ⚠ prefix + a red count badge + the row painted red