@agfpd/iapeer 0.4.95 → 0.4.96

package/docs/19-notices.md

@@ -210,13 +210,23 @@ The daemon sweeps on its own timer (`DEFAULT_MUTEWATCH_INTERVAL_MS`, 20 s — de
 is the product here, and the 60 s supervise tick would put the worst case at the budget with
 nothing to spare). A sweep only opens files whose mtime moved since the last pass.
 
-The obvious route — slugify the peer's registry `cwd` into `~/.claude/projects/<slug>` — is a
-**trap**. The slug mirrors the cwd *string as the process was launched*, not the real path.
-This host carries BOTH `-Users-macmini-Projects-IAPeer` and `-Users-macmini-Projects-iapeer`
-for one case-insensitive directory. So attribution runs the other way: read the cwd each file
-states **about itself** (claude: the `cwd` field on every line; codex: `session_meta.payload.cwd`)
-and match it against the registry, case-insensitively. A file whose cwd belongs to no peer is
-ignored — a human's own session never notifies.
+Attribution does not derive the path from `cwd`. It reads the cwd each file states **about
+itself** (claude: the `cwd` field on every line; codex: `session_meta.payload.cwd`) and matches
+it against the registry, case-insensitively. A file whose cwd belongs to no peer is ignored —
+a human's own session never notifies.
+
+The reason is that one rule must serve both runtimes: the claude slug is a naming convention we
+do not own, and a codex rollout carries no cwd in its path at all (`YYYY/MM/DD/rollout-*`), so
+there is nothing to derive from. Reading the file's own statement works for both.
+
+> **Correction (15.07.2026).** This section previously justified the choice by claiming the host
+> carries BOTH `-Users-macmini-Projects-IAPeer` and `-Users-macmini-Projects-iapeer` as two
+> directories for one case-insensitive path. **That was false.** `readdir` lists exactly one
+> (`…-IAPeer`), and both spellings `stat` to the same inode — the filesystem is case-insensitive,
+> so a slug of differing case resolves correctly, and the confirm path in `transport` derives its
+> slug this way and works. The claim came from reading a `grep -c` result of 2 whose second hit was
+> `…-Projects-iapeer-memory`: a count was trusted instead of the entries. The design choice is
+> unchanged; its stated reason is.
 
 ## 7. What is proven, and what is not
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.95",
+  "version": "0.4.96",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/daemon/mutewatch.ts

@@ -31,12 +31,18 @@
 //     binary but never observed live here), so an unknown future variant still detects.
 //     Codex DOES carry resets_at per window → its notice states the reset time.
 //
-// PATHS ARE NEVER DERIVED FROM cwd. The obvious route — slugify the peer's registry cwd into
-// ~/.claude/projects/<slug> — is a trap: the slug mirrors the cwd STRING as the process was
-// launched, not the real path. This host carries BOTH `-Users-macmini-Projects-IAPeer` and
-// `-Users-macmini-Projects-iapeer` for ONE case-insensitive directory. So we go the other way:
-// scan the session files that CHANGED, read the cwd each file states about ITSELF (claude: the
-// `cwd` field on every line; codex: session_meta.payload.cwd), and match that against the
+// PATHS ARE NOT DERIVED FROM cwd — but NOT for the reason first claimed here. The original note
+// said this host carries BOTH `-Users-macmini-Projects-IAPeer` and `-Users-macmini-Projects-iapeer`
+// as two directories. That was FALSE, and measured to be false on 15.07: readdir lists exactly one
+// (`…-IAPeer`), and both spellings stat to the SAME inode — the filesystem is case-insensitive, so
+// a slug whose case differs from the on-disk name resolves fine. (The claim came from a grep -c of
+// 2, whose second hit was `…-Projects-iapeer-memory`. The count was read instead of the entries.)
+//
+// The real reason stands on its own: the slug mirrors the cwd STRING as the process was launched,
+// which is a claude-specific naming convention we do not own, and codex has no cwd in its path at
+// all (YYYY/MM/DD/rollout-*). One attribution rule that works for both runtimes beats two derivation
+// schemes: scan the session files that CHANGED, read the cwd each file states about ITSELF (claude:
+// the `cwd` field on every line; codex: session_meta.payload.cwd), and match that against the
 // registry. A file whose cwd is no peer's is ignored — a human's own session never notifies.
 
 import { existsSync, openSync, closeSync, fstatSync, readSync, readdirSync, statSync } from 'node:fs'

package/src/transport/index.ts

@@ -182,11 +182,40 @@ const LIVENESS_POLL_MS = 100
 // `IAP_HOST_LIVENESS_GRACE_MS` overrides (operator calibration; tests set 0 for an immediate
 // deterministic fail). Prefer a false-FAIL (sender retries) over a false-OK (silent loss, forbidden).
 const CONFIRM_GRACE_MS = 4000
-function confirmGraceMs(): number {
-  const raw = process.env.IAP_HOST_LIVENESS_GRACE_MS
+
+// ATTACHMENT grace. The "sub-second" assumption above holds only WITHOUT attachments. Measured
+// 15.07.2026 on a live att=4 delivery (1.3 MB of PNGs) into an IDLE receiver: the record was
+// stamped 19:34:59.269, the confirm polled the right file until 19:35:03.4 and did not see it,
+// and the receiver's first output came at 19:35:21.7. The receiver writes the user-record when it
+// BEGINS the turn, and loading/encoding the images pushed that start ~22 s out — so a 4 s grace
+// expired on a message that had landed. Every att>0 delivery to a claude receiver false-FAILED,
+// the sender retried on the lie, and the message duplicated in the receiver's context.
+//
+// 60 s is a CONSERVATIVE BOUND FROM THAT MEASUREMENT (≤22 s observed, ×3 headroom), not a
+// calibrated number: the exact paste→disk latency is still unmeasured (see docs/10). It costs
+// nothing on the happy path — the confirm returns the moment the record lands — and costs the
+// sender up to a minute only when an attachment message genuinely fails, which is rare.
+const CONFIRM_GRACE_ATTACHMENTS_MS = 60_000
+
+function envNonNegative(raw: string | undefined): number | null {
   const n = raw === undefined ? NaN : Number(raw)
-  if (Number.isFinite(n) && n >= 0) return n
-  return CONFIRM_GRACE_MS
+  return Number.isFinite(n) && n >= 0 ? n : null
+}
+
+/** Does this envelope carry attachments — i.e. will the receiver have to ingest files before it
+ *  records anything? Same marker `confirmNeedles` splits on, so the two cannot disagree. */
+export function envelopeHasAttachments(envelope: string): boolean {
+  return envelope.includes('<attachments>') && envelope.includes('</attachments>')
+}
+
+function confirmGraceMs(hasAttachments: boolean): number {
+  // An EXPLICIT operator/test override wins for both modes — tests set 0 for a deterministic
+  // immediate fail, and an operator calibrating one number must not be silently overridden by
+  // the attachment branch.
+  const explicit = envNonNegative(process.env.IAP_HOST_LIVENESS_GRACE_MS)
+  if (explicit !== null) return explicit
+  if (!hasAttachments) return CONFIRM_GRACE_MS
+  return envNonNegative(process.env.IAP_HOST_LIVENESS_GRACE_ATTACHMENTS_MS) ?? CONFIRM_GRACE_ATTACHMENTS_MS
 }
 
 // Launchd-revive retry — a MISS on a launchd-managed target the daemon can't wake (H4)
@@ -328,7 +357,7 @@ async function deliverViaHost(
   // false-OK (silent loss the contract forbids).
   const confirm = seam.confirmLanded ?? ((payload: string) => transcriptCarriesEnvelope(baseline, payload, { env }))
   const sleep = seam.sleep ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)))
-  const graceMs = confirmGraceMs()
+  const graceMs = confirmGraceMs(envelopeHasAttachments(envelope))
   const graceDeadline = monotonicMs() + graceMs
   while (true) {
     if (confirm(envelope)) return ok(undefined)