@agfpd/iapeer 0.4.86 → 0.4.87

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.86",
+  "version": "0.4.87",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/codec/index.ts

@@ -1,10 +1,20 @@
-// IAP envelope codec — encoder + decoder, both halves in one module.
+// IAP envelope codec — wire encoder + read-both decoder + agent-facing render.
 //
-// Encoder: inter-agent-protocol/src/lib/preamble.ts buildEnvelope (wins as-is).
-// Decoder: telegram-runtime/src/cli.ts parseIapEnvelope/extractIapEnvelopes,
-//   rewritten CDATA-AWARE (blueprint-v2 codec-fixes) so that an envelope whose
-//   message contains `</iap>`, `</message>`, `]]>` or a literal CR round-trips
-//   by FIELD-semantic equivalence, not byte-equality.
+// Three halves (envelope-compaction F, 0.4.86):
+//   buildEnvelope          → the WIRE form (legacy attr names, always-CDATA, full-ISO ts) —
+//                            what bridges parse and durable stores hold; never slims.
+//   decodeEnvelope         → READ-BOTH (legacy + compact names, <message>/<msg>, ts),
+//                            CDATA-AWARE so a body containing `</iap>`, `</message>`,
+//                            `]]>` or a literal CR round-trips by FIELD-semantic
+//                            equivalence, not byte-equality.
+//   renderEnvelopeForAgent → the compact presentation for LLM-context hops (bottom).
+//
+// Historic origin: encoder from inter-agent-protocol preamble.ts; decoder from
+// telegram-runtime parseIapEnvelope/extractIapEnvelopes. The sibling runtimes run
+// their own copies of the decoder, SYNCED to this canon 14.07.2026 (telegram-runtime
+// 0.26.0, notifier-runtime 0.3.6, voicetalk-runtime 0.1.1 — anchored attrValue, В37/В38,
+// read-both); a decoder-behavior change here should be mirrored there (or flagged to
+// their implementers). The wire form stays compatible with all of them regardless.
 //
 // Deliberately NO CR→LF fold here. The old telegram decoder did
 // `xml.replace(/\r\n?/g, '\n')` to repair tmux paste (which rewrites LF→CR).
@@ -45,19 +55,20 @@ export interface EnvelopeInput {
   message: string
 }
 
+const pad2 = (n: number): string => String(n).padStart(2, '0')
+
 /** Format a Date as ISO-8601 LOCAL time with numeric offset, second precision:
  *  `2026-07-14T01:23:45+03:00`. Local (not UTC-Z) on purpose: the fleet's agents
  *  compare envelope timestamps against their LOCAL statusline clock — a Z-form
  *  invites silent off-by-offset misreads by an LLM reader. */
 export function formatSentAt(date: Date): string {
-  const pad = (n: number): string => String(n).padStart(2, '0')
   const offMin = -date.getTimezoneOffset() // minutes EAST of UTC
   const sign = offMin >= 0 ? '+' : '-'
   const abs = Math.abs(offMin)
   return (
-    `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}` +
-    `T${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}` +
-    `${sign}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`
+    `${date.getFullYear()}-${pad2(date.getMonth() + 1)}-${pad2(date.getDate())}` +
+    `T${pad2(date.getHours())}:${pad2(date.getMinutes())}:${pad2(date.getSeconds())}` +
+    `${sign}${pad2(Math.floor(abs / 60))}:${pad2(abs % 60)}`
   )
 }
 
@@ -351,11 +362,10 @@ function presentBody(value: string): string {
 function renderTsForAgent(sentAt: string, now: Date): string {
   const d = new Date(sentAt)
   if (Number.isNaN(d.getTime())) return sentAt
-  const pad = (n: number): string => String(n).padStart(2, '0')
-  const time = `${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`
+  const time = `${pad2(d.getHours())}:${pad2(d.getMinutes())}:${pad2(d.getSeconds())}`
   const sameLocalDay =
     d.getFullYear() === now.getFullYear() && d.getMonth() === now.getMonth() && d.getDate() === now.getDate()
-  return sameLocalDay ? time : `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${time}`
+  return sameLocalDay ? time : `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())} ${time}`
 }
 
 /**

package/src/core/constants.ts

@@ -89,11 +89,12 @@ export function isIntelligenceAllowedForRuntime(runtime: string, intelligence: I
 // Infra runtimes are ALWAYS-ON (held live by launchd KeepAlive), as opposed to the
 // warm-on-demand agentic runtimes (claude/codex, woken by the daemon). Liveness is
 // a property of the RUNTIME, not the personality (zone Идентичность). Infra runtimes
-// are routers hosted by the pty supervisor: telegram/voicetalk carry a human channel
-// (inbound messages / voice), notifier receives send_to_peer(timer|watcher, …)
-// registration/live-reload — outbound to each is deliverHosted → the child's stdin.
+// are routers hosted by the pty supervisor: telegram/voicetalk/web carry a human
+// channel (inbound messages / voice / browser console), notifier receives
+// send_to_peer(timer|watcher, …) registration/live-reload — outbound to each is
+// deliverHosted → the child's stdin.
 // This set gates always-on launchd plist generation (src/launch/launchd.ts).
-const INFRA_RUNTIMES = new Set(['notifier', 'telegram', 'voicetalk'])
+const INFRA_RUNTIMES = new Set(['notifier', 'telegram', 'voicetalk', 'web'])
 
 export function isInfraRuntime(runtime: string): boolean {
   return INFRA_RUNTIMES.has(runtime)
@@ -111,6 +112,7 @@ export const INFRA_RUNTIME_BIN_ENV: Readonly<Record<string, string>> = {
   notifier: 'NOTIFIER_RUNTIME_BIN',
   telegram: 'TELEGRAM_RUNTIME_BIN',
   voicetalk: 'VOICETALK_RUNTIME_BIN',
+  web: 'WEB_RUNTIME_BIN',
 }
 
 /** The PATH-resolvable default launcher name per infra runtime (when no abs path
@@ -120,6 +122,7 @@ export const INFRA_RUNTIME_DEFAULT_BIN: Readonly<Record<string, string>> = {
   notifier: 'notifier-runtime',
   telegram: 'telegram-runtime',
   voicetalk: 'voicetalk-runtime',
+  web: 'web-runtime',
 }
 
 // codex MCP token-free import (contract Установка §codex MCP). codex REFUSES to import

package/src/identity/index.ts

@@ -26,7 +26,7 @@ import {
 // KeepAlive, so creating one installs its always-on plist. Imported from the
 // launchd module directly (not the launch barrel) to keep the dependency surface
 // minimal — launchd.ts pulls only core/*, so identity → launch introduces no cycle.
-import { installAlwaysOnPlist } from '../launch/launchd.ts'
+import { installAlwaysOnPlist, installedPlistRuntime } from '../launch/launchd.ts'
 import { buildProcessAddress } from '../core/socket.ts'
 import { IapError } from '../core/errors.ts'
 import {
@@ -623,13 +623,30 @@ export function ensurePeerProfile(options: EnsurePeerProfileOptions): PeerProfil
   // and leaves no half-updated profile. Idempotent for our own (sentinel) plist.
   let intelligence = existing.intelligence
   if (isInfraRuntime(options.runtime)) {
-    installAlwaysOnPlist({
-      personality: existing.personality,
-      runtime: options.runtime,
-      cwd,
-      runtimeBin: options.runtimeBin,
-      env: options.env,
-    })
+    // MULTI-INFRA BRIDGE: the always-on plist scheme is ONE per personality, so when the
+    // personality's plist is already OCCUPIED by ANOTHER infra runtime (arthur: telegram,
+    // now declaring web), installing here would clobber the live channel — and the
+    // installAlwaysOnPlist collision guard would fail the whole declaration. Instead:
+    // DECLARE the runtime (runtimes += <rt> below — identity `<rt>-<p>` resolves, delivery
+    // to a LIVE hosted session works) but leave the first channel's plist untouched. The
+    // new runtime's session is NOT launchd-owned until per-runtime plists (multi-infra)
+    // land — bring it up manually via `iapeer run-infra <p> <rt>` meanwhile.
+    const occupied = installedPlistRuntime(existing.personality, options.env)
+    if (occupied && occupied !== options.runtime) {
+      options.warn?.(
+        `always-on plist for "${existing.personality}" already holds runtime "${occupied}" — ` +
+          `"${options.runtime}" is DECLARED but gets no launchd plist (one plist per personality); ` +
+          `until per-runtime plists land, bring the session up manually: iapeer run-infra ${existing.personality} ${options.runtime}`,
+      )
+    } else {
+      installAlwaysOnPlist({
+        personality: existing.personality,
+        runtime: options.runtime,
+        cwd,
+        runtimeBin: options.runtimeBin,
+        env: options.env,
+      })
+    }
     // Re-provision honors an EXPLICIT nature (a manifest-declared absent service bot survives
     // update-runtime re-provision), else the runtime default (the legacy vocab-flip this fix
     // preserved). resolvedIntelligence validates the explicit against the runtime's allowed set.

package/src/launch/adapters/web.ts

@@ -0,0 +1,107 @@
+// web RuntimeAdapter — the "HOW to launch / observe ONE web session" half of the
+// launch contract (src/launch/types.ts). Like telegram/voicetalk, web is a
+// long-running ROUTER (`web-runtime run`: the owner's browser fleet-console —
+// local HTTP/WebSocket server the browser client connects to → IAP envelopes to
+// the fleet; <iap>-marked stdin → rendered into the console chat), NOT an LLM TUI.
+// So kind:'router' tells launch.launch to SKIP every TUI phase — no pane boot
+// dialog, no ready-marker, no first-user-turn delivery, no activity-proxy
+// ready-gate, no permission modal, no transcript to resume. The pane predicates
+// below are therefore trivial constants, present only to satisfy the frozen
+// interface.
+//
+// web is a presence-runtime for a HUMAN (the owner's browser console), modelled on
+// telegram/voicetalk per the foundation presence-runtime contract: kind:'router',
+// usesDoctrine:false, allowedIntelligences:['natural','absent'], argv = `<bin> run
+// <extra>`. The server/client mechanics (port, tunnel, auth) live in the
+// @agfpd/web-runtime package, NOT in this adapter and NOT interpreted by the
+// foundation — interfaces.web (if the package declares one) is opaque here.
+//
+// NO sender-guard for web (the voicetalk precedent): telegramSenderGuard is
+// telegram-specific (the bridge picks the SENDING bot from the sender's
+// bot_username); web is a single local owner endpoint — the console renders the
+// sender from the envelope's `from`, so any peer may write to it freely.
+//
+// NO currency on this path: no marketplace check, no plugin install/update — that
+// is install-time (the package self-deploys its runtime.json manifest), not
+// session bring-up.
+
+import type { ControlCommand, ControlPlan, LaunchAdapterConfig, LaunchSpec, RuntimeAdapter } from '../types.ts'
+import { allowedIntelligencesForRuntime } from '../../core/constants.ts'
+
+// ─────────────────────────────────────────────────────────────────────────────
+// webAdapter
+// ─────────────────────────────────────────────────────────────────────────────
+
+export const webAdapter: RuntimeAdapter = {
+  runtime: 'web',
+  kind: 'router',
+  usesDoctrine: false,
+
+  /** No submit surface — a router takes no bracketed-paste-then-Enter turn; delivery
+   *  is deliverHosted → child stdin (<iap> reader), not submitIntoTui. Empty glyphs. */
+  deliveryMarkers: { promptGlyphs: [] },
+
+  /**
+   * web carries a HUMAN (natural) OR a FACELESS SERVICE bot (absent) — never an LLM
+   * agent (artificial), which would route the owner's console channel to an agent/script.
+   * Same nature gate as telegram/voicetalk, sourced from the single Ф0 truth
+   * (allowedIntelligencesForRuntime); enforced by the launch primitive against
+   * LaunchSpec.intelligence. Source → docs/Идентичность.
+   */
+  allowedIntelligences: allowedIntelligencesForRuntime('web'),
+
+  /**
+   * argv = webBin + 'run' + extraArgs.
+   *   - cfg.webBin ?? 'web-runtime'  the launch binary (the always-on plist pins an
+   *     absolute path via WEB_RUNTIME_BIN — launchd-minimal PATH; here we defer to
+   *     cfg.webBin when set, else emit the PATH-resolvable literal for launch.launch
+   *     to resolve).
+   *   - 'run'  the router subcommand: brings up the console server (browser client ↔
+   *     fleet) and pumps IAP envelopes both directions through the session's stdio
+   *     (outbound <iap> stdin → console chat; inbound browser input → fleet via the
+   *     daemon send_to_peer).
+   *   - ...extraArgs  LaunchSpec.extraArgs passthrough.
+   *
+   * NO --system-prompt-file: usesDoctrine:false — a router is not an LLM, no doctrine to
+   * merge. NO --resume: a router has no transcript. NO currency on this path.
+   */
+  buildArgv(spec: LaunchSpec, cfg: LaunchAdapterConfig): string[] {
+    return [cfg.webBin ?? 'web-runtime', 'run', ...(spec.extraArgs ?? [])]
+  },
+
+  /** No startup dialogs — a router has no pane TUI to answer. launch.launch skips the
+   *  boot phase for kind:'router', so this is never consulted; null = "no dialog". */
+  bootDialogKeys(_pane: string): string[] | null {
+    return null
+  },
+
+  /** Always ready: a router has no input surface waiting for a first message — it is
+   *  "up" the instant `web-runtime run` is launched. launch.launch skips the
+   *  ready-gate for kind:'router'; true = "nothing to wait for". */
+  isInputReady(_pane: string): boolean {
+    return true
+  },
+
+  /** No activity proxy: a router writes no transcript/session jsonl to mtime as a
+   *  ready-gate or idle signal. launch.launch skips the activity-proxy gate for a
+   *  router; null per the contract ("null for a router (no proxy)"). */
+  newestActivityMtime(_cwd: string): number | null {
+    return null
+  },
+
+  lastTurnMtime(_cwd: string): number | null {
+    return null // router — no transcript
+  },
+
+  /** Nothing to resume: a router does not replay a transcript, so resume cannot
+   *  fail-loud the way claude/codex do. Always {ok:true}. */
+  resolveResume(_cwd: string): { ok: boolean; ref?: string; reason?: string } {
+    return { ok: true }
+  },
+
+  /** No in-session control: a router has no TUI turn to interrupt/compact. null for
+   *  every command → the daemon/CLI surfaces an explicit "unsupported" refusal. */
+  executeControl(_command: ControlCommand): ControlPlan | null {
+    return null
+  },
+}

package/src/launch/index.ts

@@ -24,6 +24,7 @@ import { codexAdapter } from './adapters/codex.ts'
 import { telegramAdapter } from './adapters/telegram.ts'
 import { notifierAdapter } from './adapters/notifier.ts'
 import { voicetalkAdapter } from './adapters/voicetalk.ts'
+import { webAdapter } from './adapters/web.ts'
 import type {
   LaunchConfig,
   LaunchFn,
@@ -56,6 +57,7 @@ export {
   launchdPlistPath,
   renderLaunchdPlist,
   installAlwaysOnPlist,
+  installedPlistRuntime,
   isFoundationOwnedPlist,
   launchctlBootstrap,
   bootstrapJobCore,
@@ -90,6 +92,7 @@ export function getAdapter(runtime: Runtime): RuntimeAdapter {
   if (runtime === 'telegram') return telegramAdapter
   if (runtime === 'notifier') return notifierAdapter
   if (runtime === 'voicetalk') return voicetalkAdapter
+  if (runtime === 'web') return webAdapter
   throw new Error(`no launch adapter for runtime "${runtime}"`)
 }
 

package/src/launch/launchd.ts

@@ -81,6 +81,20 @@ function readPlistEnvVar(path: string, key: string): string | undefined {
   }
 }
 
+/**
+ * The PEER_RUNTIME baked into the personality's EXISTING foundation-owned always-on
+ * plist, or undefined when there is no plist / it is foreign-owned / it carries no
+ * runtime. The plist scheme is ONE per personality (`com.iapeer.<p>.plist` — the
+ * runtime rides only in ProgramArguments/env), so this is how a caller detects that
+ * the personality's always-on slot is already OCCUPIED by another infra runtime
+ * (e.g. arthur's telegram) before asking for a second one (multi-infra collision).
+ */
+export function installedPlistRuntime(personality: string, env: NodeJS.ProcessEnv = process.env): string | undefined {
+  const path = launchdPlistPath(personality, env)
+  if (!existsSync(path) || !isFoundationOwnedPlist(path)) return undefined
+  return readPlistEnvVar(path, 'PEER_RUNTIME')
+}
+
 /**
  * Resolve an executable to an ABSOLUTE path against `env.PATH` (the RICH
  * provisioning PATH), so the result can be baked into a launchd plist whose own
@@ -614,6 +628,22 @@ export function installAlwaysOnPlist(opts: InstallAlwaysOnPlistOptions): string
         `or other manager owns it; rename the peer to avoid the com.iapeer.<personality> collision`,
     )
   }
+  // MULTI-INFRA COLLISION GUARD (fail-loud, never a silent clobber): the plist scheme
+  // is ONE per personality, so installing a SECOND infra runtime for the same
+  // personality would OVERWRITE the first channel's plist (e.g. web over arthur's
+  // telegram) and kill that channel on the next bootout/reboot. Refuse loudly until
+  // per-runtime plists (multi-infra) land. A deliberate runtime SWITCH is an operator
+  // act: `iapeer stop <p>` + delete the plist, then re-provision.
+  const bakedRuntime = existsSync(path) ? readPlistEnvVar(path, 'PEER_RUNTIME') : undefined
+  if (bakedRuntime && bakedRuntime !== opts.runtime) {
+    throw new IapError(
+      `refusing to overwrite launchd plist ${path}: it already holds the always-on ` +
+        `"${bakedRuntime}" session for "${opts.personality}" (the plist scheme is one per ` +
+        `personality) — installing "${opts.runtime}" here would silently kill that channel. ` +
+        `Multi-infra per personality needs per-runtime plists (not yet supported); for a ` +
+        `deliberate runtime switch: iapeer stop ${opts.personality}, delete the plist, re-provision.`,
+    )
+  }
   // GLOBAL infra logs (Фаза §8): ~/.iapeer/logs/<personality>/, NOT per-peer
   // <cwd>/.iapeer/logs/ — host-service logs live in the global log area.
   const logDir = peerLogsDir(opts.personality, { env })

package/src/launch/launchdRun.ts

@@ -97,6 +97,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
     telegramBin: env[INFRA_RUNTIME_BIN_ENV.telegram],
     notifierBin: env[INFRA_RUNTIME_BIN_ENV.notifier],
     voicetalkBin: env[INFRA_RUNTIME_BIN_ENV.voicetalk],
+    webBin: env[INFRA_RUNTIME_BIN_ENV.web],
     sockDir,
     bootDeadlineSecs: 30,
     readyGateSecs: 30,

package/src/launch/types.ts

@@ -141,6 +141,8 @@ export interface LaunchAdapterConfig {
   notifierBin?: string
   /** voicetalk-runtime launch binary (router runtime, infra/always-on — the owner's voice channel). */
   voicetalkBin?: string
+  /** web-runtime launch binary (router runtime, infra/always-on — the owner's browser fleet-console). */
+  webBin?: string
 }
 
 export interface LaunchSpec {

package/src/lifecycle/index.ts

@@ -1320,10 +1320,17 @@ interface SuperviseCtx {
  */
 function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome {
   const { cfg, env, nowMs, lastTurnMt, childActivityMt, isAlive, kill, verbose, trace } = ctx
-  // H4 — FIRST, before any reap. A launchd-managed peer is read-only.
+  // H4 — FIRST, before any reap. A launchd-managed peer is read-only: never wake,
+  // never kill, never sweep its PROCESS. Its stale `.session` however is the
+  // DAEMON'S own supervisory record (written back when the peer was daemon-owned),
+  // not the peer's — a peer that moved under launchd would otherwise re-enter this
+  // skip on every tick forever (follow-up 09.06: latent garbage, not a delivery
+  // bug). Drop the record once; if the plist is ever removed again, the next wake
+  // recreates it.
   if (isLaunchdManaged(s.personality, env)) {
-    if (verbose) trace({ identity: s.identity, action: 'skipped-launchd', outcome: 'read-only-h4' })
-    return { identity: s.identity, action: 'skipped-launchd' }
+    removeSessionState(cfg, s.identity)
+    if (verbose) trace({ identity: s.identity, action: 'skipped-launchd', outcome: 'read-only-h4-stale-state-dropped' })
+    return { identity: s.identity, action: 'skipped-launchd', reason: 'launchd-managed; stale daemon .session dropped' }
   }
   const sock = buildSocketPath(s.runtime, s.personality, cfg.sockDir)
   if (!isAlive(sock, s.identity)) {

package/src/runtime/deploy.ts

@@ -33,6 +33,7 @@ export const RUNTIME_PACKAGES: Readonly<Record<string, string>> = {
   telegram: '@agfpd/telegram-runtime',
   notifier: '@agfpd/notifier-runtime',
   voicetalk: '@agfpd/voicetalk-runtime',
+  web: '@agfpd/web-runtime',
 }
 
 /** Resolve the npm package for a runtime: explicit override wins, else the built-in

package/src/transport/index.ts

@@ -308,11 +308,13 @@ async function deliverViaHost(
   // codex took the socket-ack short-circuit above). A bare transcript/pane-log mtime BUMP is NOT proof
   // the session took THIS message: a receiver in an active turn advances both mtimes with its OWN
   // rendering even when our paste was swallowed at the turn boundary (incident 2026-06-23: ok=true,
-  // message gone). The ONLY proof is a NEW transcript record CARRYING our envelope — for claude, a
-  // queue-operation `content` (busy → enqueued) or the user-turn message (idle), written sub-second so
-  // a short grace covers it. The receiver's own assistant/tool turn never reproduces the
-  // `<iap from-personality=…>` wrapper, so it cannot forge a confirm. No such record within the grace →
-  // false-FAIL (the sender retries) — NOT a false-OK (silent loss the contract forbids).
+  // message gone). The ONLY proof is a NEW transcript record CARRYING the DELIVERED payload (for an
+  // agent target that is the compact `<iap from=…>` presentation — deliverWarm rendered it before this
+  // point, so the needle matches what was actually pasted) — for claude, a queue-operation `content`
+  // (busy → enqueued) or the user-turn message (idle), written sub-second so a short grace covers it.
+  // The receiver's own assistant/tool turn never reproduces the full delivered envelope verbatim, so it
+  // cannot forge a confirm. No such record within the grace → false-FAIL (the sender retries) — NOT a
+  // false-OK (silent loss the contract forbids).
   const confirm = seam.confirmLanded ?? ((payload: string) => transcriptCarriesEnvelope(baseline, payload, { env }))
   const sleep = seam.sleep ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)))
   const graceMs = confirmGraceMs()