@agfpd/iapeer 0.4.76 → 0.4.78

package/docs/16-tray.md

@@ -34,24 +34,28 @@ activation that also installs SwiftBar.app when it is absent.
     a human is attached, `🔒` launchd-managed (H4 read-only), `🛡` the peer runs in **gated**
     human-approval mode (docs/17; `yolo` is the fleet default and carries no badge — a bare
     row reads as yolo), `⏳N` an ephemeral peer's queue depth.
-  - **Click an agent peer → Terminal.app running `iapeer attach <peer>`.** The row itself is
-    the attach action (no submenu, so a click attaches rather than merely expanding). The
-    handoff goes through `iapeer tray attach-term`, which writes a per-peer `.command`
-    launcher and `open`s it — `open <file>.command` hands the file to Terminal.app with
-    **no Automation/Accessibility permission prompt**. This deliberately avoids SwiftBar's
-    own `terminal=true`, whose Terminal launch drives a `Cmd-T` System-Events keystroke that
-    silently no-ops unless SwiftBar holds Accessibility permission. **Launchd-managed infra
-    peers (telegram / notifier, `🔒`) are not pty-attachable** — their rows are plain status
-    lines. Lifecycle actions (Stop / Start / New / Interrupt / Refresh / Compact) live
-    in the **Manage** submenu, each a `POST /fleet/v1/peers/<peer>/<cmd>` via `iapeer tray cmd`.
-    (No Wake item — a peer-row click already wakes a sleeping peer before it attaches, so
-    it was redundant.) For an agentic peer the Manage submenu also carries an
-    **approval-mode toggle** (docs/17): it reads the current mode and flips it via the local
-    `iapeer approval-mode <peer> <mode>` verb, applied on the peer's **next fresh session**
-    (a click never respawns a live session). The friction is asymmetric to the security
-    weight: `yolo → gated` (adds human approval) is one safe tap; `gated → yolo` (REMOVES the
-    approval perimeter) sits behind the submenu as an explicit red ⚠ confirm, so it is never
-    dropped by a stray click.
+  - **Each peer is a SUBMENU** — one unified list (no separate Manage section; the peer rows
+    and a parallel Manage list of every peer used to be a visible dupe). Clicking a peer
+    EXPANDS it; its actions are the children, in order:
+    - **Attach** (agent peers only) — the FIRST child. Runs `iapeer tray attach-term <peer>`,
+      which writes a per-peer `.command` launcher and `open`s it — `open <file>.command` hands
+      the file to Terminal.app with **no Automation/Accessibility permission prompt** (this
+      deliberately avoids SwiftBar's own `terminal=true`, whose Terminal launch drives a `Cmd-T`
+      System-Events keystroke that silently no-ops unless SwiftBar holds Accessibility). Attach
+      is now expand-then-Attach (two clicks) — the trade for a single dupe-free list.
+    - **Lifecycle** — Stop / Start / New / Interrupt / Refresh / Compact, each a
+      `POST /fleet/v1/peers/<peer>/<cmd>` via `iapeer tray cmd`. (No Wake item — a peer-row
+      click path already wakes a sleeping peer before it attaches, so it was redundant.)
+    - **Approval-mode toggle** (agent peers only, docs/17): reads the current mode and flips it
+      via the local `iapeer approval-mode <peer> <mode>` verb, applied on the peer's **next fresh
+      session** (a click never respawns a live session). The friction is asymmetric to the
+      security weight: `yolo → gated` (adds human approval) is one safe tap; `gated → yolo`
+      (REMOVES the approval perimeter) sits one level deeper behind an explicit red ⚠ confirm, so
+      it is never dropped by a stray click.
+
+    **Launchd-managed infra peers (telegram / notifier, `🔒`)** are not pty-attachable, so their
+    submenu carries **no Attach** and **no approval toggle** (always yolo) — just the lifecycle
+    commands (service Stop / Start etc.).
 - **Pending approvals (docs/17):** when the queue is non-empty, the **top of the dropdown** shows
   each pending request **expanded, with no extra clicks** — a header (`<peer> · <tool>`), the
   **verbatim action content** (the command / diff / plan, monospace, capped for the menu; the FULL

package/docs/ru/16-tray.md

@@ -32,22 +32,28 @@ SwiftBar.app, если его нет.
     `👤` подключён человек, `🔒` под launchd (H4 read-only), `🛡` пир в режиме **gated**
     human-approval (docs/17; `yolo` — дефолт флота, без бейджа: голая строка читается как yolo),
     `⏳N` глубина очереди эфемерного пира.
-  - **Клик по агент-пиру → Terminal.app с `iapeer attach <peer>`.** Строка сама и есть действие
-    attach (без подменю — клик аттачит, а не раскрывает). Передача идёт через `iapeer tray
-    attach-term`: пишет per-peer `.command`-лаунчер и `open`'ит его — `open <файл>.command`
-    отдаёт файл Terminal.app **без запроса Automation/Accessibility**. Это намеренно обходит
-    родной `terminal=true` SwiftBar, чей запуск Terminal бьёт `Cmd-T` кейстроком через System
-    Events и молча не срабатывает без права Accessibility у SwiftBar. **Launchd-инфра-пиры
-    (telegram / notifier, `🔒`) не pty-аттачатся** — их строки просто статус. Lifecycle-действия
-    (Stop / Start / New / Interrupt / Refresh / Compact) — в подменю **Manage**, каждое —
-    `POST /fleet/v1/peers/<peer>/<cmd>` через `iapeer tray cmd`. (Пункта Wake нет — клик по строке
-    пира и так будит спящего перед аттачем, отдельный Wake был избыточен.) Для агентного пира
-    подменю Manage несёт ещё **переключатель approval-режима** (docs/17): читает текущий режим и
-    флипает его локальным verb'ом `iapeer approval-mode <peer> <mode>`, применяется на **следующей
-    свежей сессии** пира (клик никогда не респавнит живую сессию). Трение асимметрично весу
-    безопасности: `yolo → gated` (добавляет human-approval) — один безопасный тап; `gated → yolo`
-    (СНИМАЕТ периметр approval) спрятан в подменю как явный красный ⚠ confirm, чтобы его не сбросить
-    случайным кликом.
+  - **Каждый пир — ПОДМЕНЮ** — один единый список (без отдельной секции Manage; строки пиров и
+    параллельный Manage-список всех пиров раньше были видимым дублем). Клик по пиру РАСКРЫВАЕТ
+    его; действия — дочерние пункты, по порядку:
+    - **Attach** (только агент-пиры) — ПЕРВЫЙ пункт. Запускает `iapeer tray attach-term <peer>`:
+      пишет per-peer `.command`-лаунчер и `open`'ит его — `open <файл>.command` отдаёт файл
+      Terminal.app **без запроса Automation/Accessibility** (намеренно обходит родной
+      `terminal=true` SwiftBar, чей запуск Terminal бьёт `Cmd-T` кейстроком через System Events и
+      молча не срабатывает без права Accessibility). Attach теперь = раскрыть-и-Attach (два клика) —
+      плата за единый список без дубля.
+    - **Lifecycle** — Stop / Start / New / Interrupt / Refresh / Compact, каждое —
+      `POST /fleet/v1/peers/<peer>/<cmd>` через `iapeer tray cmd`. (Пункта Wake нет — путь клика по
+      пиру и так будит спящего перед аттачем, отдельный Wake избыточен.)
+    - **Переключатель approval-режима** (только агент-пиры, docs/17): читает текущий режим и флипает
+      локальным verb'ом `iapeer approval-mode <peer> <mode>`, применяется на **следующей свежей
+      сессии** пира (клик никогда не респавнит живую сессию). Трение асимметрично весу безопасности:
+      `yolo → gated` (добавляет human-approval) — один безопасный тап; `gated → yolo` (СНИМАЕТ
+      периметр approval) на уровень глубже за явным красным ⚠ confirm, чтобы не сбросить случайным
+      кликом.
+
+    **Launchd-инфра-пиры (telegram / notifier, `🔒`)** не pty-аттачатся — их подменю несёт **без
+    Attach** и **без approval-переключателя** (всегда yolo), только lifecycle-команды (Stop / Start
+    сервиса и т.д.).
 - **Ожидающие подтверждения (docs/17):** когда очередь непуста, **вверху выпадашки** каждый
   ожидающий запрос показан **раскрытым, без доп. кликов** — заголовок (`<peer> · <tool>`),
   **дословное содержимое действия** (команда / диф / план, моноширинно, усечено для меню; ПОЛНОЕ

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.76",
+  "version": "0.4.78",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/approval/hook.ts

@@ -112,10 +112,20 @@ function throwEvent(v: unknown): never {
   throw new Error(`hook stdin has an unexpected hook_event_name "${String(v)}"`)
 }
 
-/** The decision JSON in the shape the given event accepts. A deny carries the reason to the
- *  model. PermissionRequest uses `decision.behavior` (+ `message`); PreToolUse uses
- *  `permissionDecision` (+ `permissionDecisionReason`) — both verified live 2.1.201 / codex 0.142.5. */
-export function formatHookDecision(d: ApprovalDecision, event: HookEvent): string {
+/**
+ * The decision JSON in the shape the given event (and runtime) accepts. A deny carries the
+ * reason to the model. PermissionRequest uses `decision.behavior` (+ `message`); PreToolUse
+ * uses `permissionDecision` (+ `permissionDecisionReason`).
+ *
+ * codex vs claude on the PreToolUse **allow** path (VERIFIED LIVE, codex-cli 0.142.5): codex
+ * honors ONLY `permissionDecision:"deny"` — emitting `permissionDecision:"allow"` marks the
+ * hook **Failed** (fail-open, the "PreToolUse Failed"/"unsupported permissionDecision:allow"
+ * the operator saw). The clean allow on codex is to **abstain**: emit NOTHING (exit 0) → codex
+ * marks the hook **Completed** and the tool proceeds under the gated bypass base (approval is a
+ * DENY-or-abstain gate on codex, not a two-sided allow/deny one). claude's PreToolUse DOES honor
+ * `permissionDecision:"allow"`, so it keeps the affirmative form. Deny is identical on both.
+ */
+export function formatHookDecision(d: ApprovalDecision, event: HookEvent, runtime = 'claude'): string {
   if (event === 'PermissionRequest') {
     return JSON.stringify({
       hookSpecificOutput: {
@@ -124,11 +134,19 @@ export function formatHookDecision(d: ApprovalDecision, event: HookEvent): strin
       },
     })
   }
+  // PreToolUse
+  if (d.decision === 'allow') {
+    // codex: abstain (empty output) — an affirmative "allow" fails the hook (verified live 0.142.5).
+    if (runtime === 'codex') return ''
+    // claude: affirmative allow is honored.
+    return JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' } })
+  }
+  // deny (+ reason) — honored identically on claude and codex.
   return JSON.stringify({
     hookSpecificOutput: {
       hookEventName: 'PreToolUse',
-      permissionDecision: d.decision,
-      ...(d.decision === 'deny' && d.reason ? { permissionDecisionReason: d.reason } : {}),
+      permissionDecision: 'deny',
+      ...(d.reason ? { permissionDecisionReason: d.reason } : {}),
     },
   })
 }
@@ -162,6 +180,9 @@ export async function runApprovalHook(stdin: string, deps: RunHookDeps = {}): Pr
   const env = deps.env ?? process.env
   const doFetch = deps.fetch ?? fetch
   const timeoutMs = deps.timeoutMs
+  // Runtime resolved up front so BOTH the success and the fail-safe-deny paths format for the
+  // right runtime (codex's allow-shape differs from claude's — see formatHookDecision).
+  const runtime = env.PEER_RUNTIME?.trim() || 'claude'
   let event: HookEvent
   let toolName: string
   let toolInput: Record<string, unknown> | undefined
@@ -174,18 +195,17 @@ export async function runApprovalHook(stdin: string, deps: RunHookDeps = {}): Pr
   try {
     const personality = env.PEER_PERSONALITY?.trim()
     if (!personality) throw new Error('no PEER_PERSONALITY in the hook environment')
-    const runtime = env.PEER_RUNTIME?.trim() || 'claude'
     const { kind, content, summary } = actionContent(toolName, toolInput)
     const decision = await requestApproval(
       resolveFleetBase(env),
       { personality, runtime, kind, tool: toolName, content, summary },
       { env, fetch: doFetch, timeoutMs },
     )
-    return { stdout: formatHookDecision(decision, event), stderr: '', exitCode: 0 }
+    return { stdout: formatHookDecision(decision, event, runtime), stderr: '', exitCode: 0 }
   } catch (e) {
     // Event known → event-appropriate DENY JSON (never allow-by-accident, never hang).
     return {
-      stdout: formatHookDecision({ decision: 'deny', reason: `iapeer approval unavailable (${e instanceof Error ? e.message : String(e)}) — denied fail-safe` }, event),
+      stdout: formatHookDecision({ decision: 'deny', reason: `iapeer approval unavailable (${e instanceof Error ? e.message : String(e)}) — denied fail-safe` }, event, runtime),
       stderr: '',
       exitCode: 0,
     }

package/src/tray/render.ts

@@ -198,19 +198,17 @@ export function renderSwiftBar(snapshot: TraySnapshot, opts: RenderOptions): str
   if (providers) lines.push(line(0, providers, { color: COLOR.meta }))
   lines.push('---')
 
-  // ── peers (each row is a DIRECT attach action — click → Terminal) ──
+  // ── peers — each peer is a SUBMENU: expand → Attach (first) + its actions. ONE list
+  //    (no separate Manage section): the peer rows and their lifecycle used to be two
+  //    parallel lists of every peer (a click-attach list + a Manage list) — a visible
+  //    dupe. Folded here (owner decision — 2 clicks to attach: expand peer → Attach). ──
   if (peers.length === 0) {
     lines.push(line(0, 'no peers registered', { color: COLOR.meta }))
   }
   for (const p of peers) {
-    lines.push(renderPeerRow(p, bin, now, pendingByPeer.get(p.personality) ?? 0))
+    lines.push(...renderPeerSubmenu(p, bin, now, pendingByPeer.get(p.personality) ?? 0))
   }
 
-  // ── Manage submenu (lifecycle commands per peer; kept off the rows so a row click
-  //    attaches instead of just expanding a submenu) ──
-  lines.push('---')
-  lines.push(...renderManage(peers, bin))
-
   // ── footer ──
   // No explicit "Refresh" item: the plugin is streamable + SSE-driven, so the menu is
   // always current on open — a manual refresh gives the user nothing and (being a
@@ -243,64 +241,52 @@ function attachable(p: TrayPeer): boolean {
   return !p.launchd_managed
 }
 
-/**
- * One peer row. For an ATTACHABLE peer the row IS a DIRECT attach action (no submenu,
- * so a click attaches instead of merely expanding): clicking runs `iapeer tray
- * attach-term <peer>` in the BACKGROUND (terminal=false), which opens a `.command` via
- * `open` — a system-Terminal handoff that needs NO Accessibility/Automation TCC. This
- * deliberately AVOIDS SwiftBar's own `terminal=true`, whose Terminal.app launch drives a
- * `Cmd-T` System-Events keystroke that silently no-ops without Accessibility permission.
- * Infra (launchd) rows are plain status lines. Lifecycle lives in the Manage submenu.
- */
-function renderPeerRow(p: TrayPeer, bin: string, now: number, pendingCount = 0): string {
-  const agg = aggregate(p)
+/** The status label for a peer's submenu-parent row: `<peer>  <rt><glyph> … <badges> <age>`.
+ *  Badges: 👤 attached · 🔒 launchd · 🛡 gated approval (docs/17; yolo=fleet default=no badge) ·
+ *  ⏳N ephemeral queue. A pending approval prepends ⚠ + a 🔴N count so the owner sees WHICH peer
+ *  waits (the Allow/Deny itself lives in the top approvals section, not here). */
+function peerLabel(p: TrayPeer, now: number, pendingCount: number): string {
   const detail = p.runtimes.map(r => `${r.runtime}${GLYPH[r.status]}`).join(' ')
-  // approval mode (docs/17): the whole fleet defaults to `yolo`, so showing it on every row is
-  // noise — mark ONLY the exception, `gated` (this peer's blocking approvals go to a human), with a
-  // 🛡 shield. No badge ⇒ yolo (the default; also how a pre-approval snapshot with the field absent
-  // renders). So the row reads the mode: 🛡 = gated, bare = yolo.
   const badges =
     (p.attached ? ' 👤' : '') +
     (p.launchd_managed ? ' 🔒' : '') +
     (p.approval_mode === 'gated' ? ' 🛡' : '') +
     (p.wake_policy === 'ephemeral' && (p.queue_depth ?? 0) > 0 ? ` ⏳${p.queue_depth}` : '')
   const ageStr = p.last_active_ms ? `  ${fmtAge(p.last_active_ms, now)}` : ''
-  // HIGHLIGHT a peer with a pending approval: a ⚠ prefix + a red count badge + the row painted red
-  // so the owner sees WHICH peer is waiting (owner criterion — the static-menu equivalent of a pulse;
-  // SwiftBar cannot animate). The highlight wins over the live/meta color.
   const prefix = pendingCount > 0 ? '⚠ ' : ''
   const pendingBadge = pendingCount > 0 ? ` 🔴${pendingCount}` : ''
-  const label = `${prefix}${p.personality}  ${detail}${badges}${pendingBadge}${ageStr}`
-  const rowColor = pendingCount > 0 ? COLOR.down : agg === 'live' ? COLOR.live : COLOR.meta
-  if (!attachable(p)) return line(0, label, { color: rowColor })
-  return line(0, label, { color: rowColor, bash: bin, param1: 'tray', param2: 'attach-term', param3: p.personality, terminal: false })
+  return `${prefix}${p.personality}  ${detail}${badges}${pendingBadge}${ageStr}`
 }
 
-/** The Manage submenu: one sub-submenu per peer with its lifecycle commands, each a
- *  `iapeer tray cmd <c> <peer>` → POST /fleet/v1/peers/<peer>/<c> (terminal=false,
- *  refresh to reflect the outcome). Kept OFF the peer rows so a row click attaches. */
-function renderManage(peers: TrayPeer[], bin: string): string[] {
-  const out: string[] = [line(0, 'Manage', { sfimage: 'slider.horizontal.3' })]
-  for (const p of peers) {
-    out.push(line(1, p.personality))
-    for (const c of MANAGE_COMMANDS) {
-      // No refresh=true: the SSE stream reflects the command's lifecycle event on its
-      // own (streamable is always fresh); a refresh would only restart the stream.
-      out.push(
-        line(2, c.label, {
-          bash: bin,
-          param1: 'tray',
-          param2: 'cmd',
-          param3: c.cmd,
-          param4: p.personality,
-          terminal: false,
-        }),
-      )
-    }
-    // approval-mode toggle — only for agentic (attachable) peers; meaningless for the
-    // human channel / notifier infra (arthur/timer/watcher), which are always yolo.
-    if (attachable(p)) out.push(...renderApprovalToggle(p, bin))
+/**
+ * One peer as a SUBMENU (single unified list — no separate Manage). The parent row is the
+ * status label (no direct action — clicking EXPANDS); the children are, in order:
+ *   1. **Attach** (agentic peers only) — the terminal handoff, unchanged (0.4.67): `iapeer tray
+ *      attach-term <peer>` in the BACKGROUND (terminal=false) opens a `.command` via `open`, needing
+ *      NO Accessibility/Automation TCC (avoids SwiftBar's `terminal=true` Cmd-T keystroke). This is
+ *      the ONE trade Arthur accepted: attach is now expand-then-Attach (2 clicks) for a dupe-free list.
+ *   2. lifecycle commands (Stop/Start/New/Interrupt/Refresh/Compact) — `iapeer tray cmd <c> <peer>`.
+ *   3. approval-mode toggle (agentic peers only — docs/17).
+ *
+ * Launchd-managed peers (arthur/timer/watcher, 🔒): NO Attach (no pty session) and NO approval toggle
+ * (always yolo); they keep the lifecycle submenu (service Stop/Start etc — the SAME set the old Manage
+ * already offered them, just relocated under the peer). Per-infra-type trimming (e.g. dropping
+ * Interrupt/Compact for the human peer) is a separate call, out of scope for a de-dupe render change.
+ */
+function renderPeerSubmenu(p: TrayPeer, bin: string, now: number, pendingCount = 0): string[] {
+  const rowColor = pendingCount > 0 ? COLOR.down : aggregate(p) === 'live' ? COLOR.live : COLOR.meta
+  const out: string[] = [line(0, peerLabel(p, now, pendingCount), { color: rowColor })]
+  // 1) Attach FIRST (agentic only — launchd infra/human peers have no pty session to attach)
+  if (attachable(p)) {
+    out.push(line(1, 'Attach', { bash: bin, param1: 'tray', param2: 'attach-term', param3: p.personality, terminal: false }))
+  }
+  // 2) lifecycle commands — each `iapeer tray cmd <c> <peer>` → POST /fleet/v1/peers/<peer>/<c>.
+  //    No refresh=true: the SSE stream reflects the outcome (streamable is always fresh).
+  for (const c of MANAGE_COMMANDS) {
+    out.push(line(1, c.label, { bash: bin, param1: 'tray', param2: 'cmd', param3: c.cmd, param4: p.personality, terminal: false }))
   }
+  // 3) approval-mode toggle (agentic only)
+  if (attachable(p)) out.push(...renderApprovalToggle(p, bin, 1))
   return out
 }
 
@@ -325,7 +311,7 @@ function renderManage(peers: TrayPeer[], bin: string): string[] {
  * stray click. SwiftBar has no native confirm dialog — the nested explicit item IS the
  * confirm.
  */
-function renderApprovalToggle(p: TrayPeer, bin: string): string[] {
+function renderApprovalToggle(p: TrayPeer, bin: string, depth: number): string[] {
   const flip = (target: 'gated' | 'yolo'): Record<string, string | boolean> => ({
     bash: bin,
     param1: 'approval-mode',
@@ -337,12 +323,12 @@ function renderApprovalToggle(p: TrayPeer, bin: string): string[] {
   if (p.approval_mode === 'gated') {
     // WEAKEN — current on the parent (no action); the flip is an explicit red confirm child.
     return [
-      line(2, 'Approval: gated 🛡', { color: COLOR.warn }),
-      line(3, '⚠ Switch to yolo — removes human approval (next session)', { color: COLOR.down, ...flip('yolo') }),
+      line(depth, 'Approval: gated 🛡', { color: COLOR.warn }),
+      line(depth + 1, '⚠ Switch to yolo — removes human approval (next session)', { color: COLOR.down, ...flip('yolo') }),
     ]
   }
   // STRENGTHEN (yolo → gated) — safe, one tap.
-  return [line(2, 'Approval: yolo → gated 🛡 (next session)', flip('gated'))]
+  return [line(depth, 'Approval: yolo → gated 🛡 (next session)', flip('gated'))]
 }
 
 // ── approval renderers (docs/17 — the always-on approval channel in the bar) ─────