@agfpd/iapeer 0.4.98 → 0.4.100

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.98",
+  "version": "0.4.100",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/daemon/mutewatch.ts

@@ -45,10 +45,11 @@
 // the `cwd` field on every line; codex: session_meta.payload.cwd), and match that against the
 // registry. A file whose cwd is no peer's is ignored — a human's own session never notifies.
 
-import { existsSync, openSync, closeSync, fstatSync, readSync, readdirSync, statSync } from 'node:fs'
+import { existsSync, readdirSync, statSync } from 'node:fs'
 import { join } from 'node:path'
 import type { LifecycleConfig } from '../lifecycle/index.ts'
 import type { NoticeBoard } from './notices.ts'
+import { readSessionSlices } from './sessionfiles.ts'
 
 /** How much of a session file's tail is parsed. The evidence is always at the end. */
 const TAIL_BYTES = 256 * 1024
@@ -229,32 +230,6 @@ export function parseCodexRollout(text: string, sinceMs: number, head = ''): Raw
 // The sweep — find changed session files, attribute them, raise notices
 // ─────────────────────────────────────────────────────────────────────────────
 
-function readTail(path: string, maxBytes = TAIL_BYTES): { tail: string; head: string } | null {
-  try {
-    const fd = openSync(path, 'r')
-    try {
-      const size = fstatSync(fd).size
-      if (size <= 0) return null
-      const off = Math.max(0, size - maxBytes)
-      const buf = Buffer.alloc(size - off)
-      readSync(fd, buf, 0, buf.length, off)
-      let head = ''
-      if (off > 0) {
-        // The tail cut away the file's start — read a HEAD slice too (codex session_meta
-        // is line 1, and a long session pushes it far out of the tail).
-        const hb = Buffer.alloc(Math.min(64 * 1024, off))
-        readSync(fd, hb, 0, hb.length, 0)
-        head = hb.toString('utf8')
-      }
-      return { tail: buf.toString('utf8'), head }
-    } finally {
-      closeSync(fd)
-    }
-  } catch {
-    return null
-  }
-}
-
 function safeReaddir(dir: string): string[] {
   try {
     return readdirSync(dir)
@@ -336,12 +311,12 @@ export function scanMuteEvents(deps: ScanDeps, sinceMs: number): MuteDetection[]
   }
   // claude: ~/.claude/projects/<slug>/<sessionId>.jsonl — one level of slug dirs.
   for (const file of changedJsonl(deps.claudeProjectsDir, floor, 1)) {
-    const t = readTail(file)
+    const t = readSessionSlices(file, TAIL_BYTES)
     if (t) push(parseClaudeTranscript(t.tail, floor), 'claude')
   }
   // codex: ~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl
   for (const file of changedJsonl(deps.codexSessionsDir, floor, CODEX_WALK_DEPTH)) {
-    const t = readTail(file)
+    const t = readSessionSlices(file, TAIL_BYTES)
     if (t) push(parseCodexRollout(t.tail, floor, t.head), 'codex')
   }
   return out

package/src/daemon/sessionfiles.ts

@@ -0,0 +1,121 @@
+// Session-file reading — the ONE place that knows how to get evidence out of a runtime's own
+// session JSONL (claude transcript / codex rollout). Shared by every cwd-attributed detector:
+// mutewatch (docs/19), turnwatch (docs/15 §Activity).
+//
+// WHY THIS MODULE EXISTS — a bug, measured on real bytes 16.07.2026.
+//
+// Both detectors need two slices of a session file: the TAIL (where the evidence is) and, for
+// codex, the HEAD (where `session_meta` states the cwd that attributes the file to a peer). The
+// head was read as a FIXED 64 KB slice. That is wrong, and it failed silently:
+//
+//   `session_meta` is ONE line, and it carries the session's composed doctrine — so its size
+//   scales with the peer's own instructions. Measured on this host: 45 KB for one peer, 65 KB
+//   for another, and **79 KB** for another. A 64 KB slice cuts that line mid-JSON, the parse
+//   throws, no cwd is ever found, and the file is treated as unattributable — i.e. as a human's
+//   own session. The peer VANISHES from the detector entirely.
+//
+// The failure mode is the nastiest kind: no error, no log, no partial result — a real peer that
+// simply never appears, and the bigger its doctrine the more certainly it disappears. It was
+// invisible in tests because fixtures have small metas; it surfaced only against the live tree,
+// where the peer with the largest doctrine was the one silently missing.
+//
+// THE RULE: never slice a line at a fixed size to parse it. Read the LINE. `readFirstLine`
+// scans forward until the first newline (bounded), so it is correct at any doctrine size and
+// costs one extra chunk read only for the files that need it.
+
+import { closeSync, fstatSync, openSync, readSync } from 'node:fs'
+
+/** Chunk size for the forward scan. One read covers the common case. */
+const HEAD_CHUNK_BYTES = 64 * 1024
+
+/**
+ * Upper bound on the first line. Generous on purpose — a doctrine can grow, and the cost of
+ * being wrong is a peer disappearing, while the cost of a larger bound is one read of a file
+ * we are already reading. A line longer than this yields '' (unattributable) rather than a
+ * truncated parse that would lie.
+ */
+export const MAX_FIRST_LINE_BYTES = 4 * 1024 * 1024
+
+/**
+ * The file's FIRST LINE (without the trailing newline), read forward in bounded chunks.
+ * Returns '' if the bound is hit before a newline — the honest "cannot read it" rather than a
+ * fragment. Never throws.
+ */
+export function readFirstLine(path: string, maxBytes = MAX_FIRST_LINE_BYTES): string {
+  let fd: number | null = null
+  try {
+    fd = openSync(path, 'r')
+    const size = fstatSync(fd).size
+    if (size <= 0) return ''
+    const limit = Math.min(size, maxBytes)
+    let acc = ''
+    let off = 0
+    while (off < limit) {
+      const want = Math.min(HEAD_CHUNK_BYTES, limit - off)
+      const buf = Buffer.alloc(want)
+      const got = readSync(fd, buf, 0, want, off)
+      if (got <= 0) break
+      const chunk = buf.subarray(0, got).toString('utf8')
+      const nl = chunk.indexOf('\n')
+      if (nl >= 0) return acc + chunk.slice(0, nl)
+      acc += chunk
+      off += got
+    }
+    // Reached EOF within the bound with no newline: the whole file IS one line — return it.
+    // (`off < limit` above only exits early when we hit the bound BEFORE EOF; a file smaller
+    // than the bound falls through to here with its complete single line in `acc`.)
+    if (off >= size) return acc
+    return '' // hit the bound before EOF → refuse to hand back a fragment of a longer line
+  } catch {
+    return ''
+  } finally {
+    if (fd !== null) {
+      try {
+        closeSync(fd)
+      } catch {
+        /* best-effort */
+      }
+    }
+  }
+}
+
+export interface SessionSlices {
+  /** The last `tailBytes` of the file — where every detector's evidence lives. */
+  tail: string
+  /** The file's first line, when the tail did not already contain the file start. Empty
+   *  otherwise (the tail already has it) or when it could not be read. */
+  head: string
+}
+
+/**
+ * Read a session file's tail plus, when the tail cut the start away, its first line.
+ * Returns null for an empty/unreadable file. Never throws — a detector sweep must survive any
+ * file on disk.
+ */
+export function readSessionSlices(path: string, tailBytes: number): SessionSlices | null {
+  let fd: number | null = null
+  try {
+    fd = openSync(path, 'r')
+    const size = fstatSync(fd).size
+    if (size <= 0) return null
+    const off = Math.max(0, size - tailBytes)
+    const buf = Buffer.alloc(size - off)
+    readSync(fd, buf, 0, buf.length, off)
+    const tail = buf.toString('utf8')
+    closeSync(fd)
+    fd = null
+    // Only when the tail cut the start away does the first line need its own read.
+    const head = off > 0 ? readFirstLine(path) : ''
+    return { tail, head }
+  } catch {
+    return null
+  } finally {
+    if (fd !== null) {
+      try {
+        closeSync(fd)
+      } catch {
+        /* best-effort */
+      }
+    }
+  }
+}

package/src/daemon/turnwatch.ts

@@ -56,15 +56,14 @@
 // IDLE codex pane-log freezes (39s→46s). The signal means opposite things per runtime; one
 // clock that lies differently on each runtime is worse than no clock.
 
-import { existsSync, openSync, closeSync, fstatSync, readSync, readdirSync, statSync } from 'node:fs'
+import { existsSync, readdirSync, statSync } from 'node:fs'
 import { join } from 'node:path'
 import type { LifecycleConfig } from '../lifecycle/index.ts'
 import { appendTurnEvent } from './turnslog.ts'
+import { readSessionSlices } from './sessionfiles.ts'
 
 /** Tail parsed per session file. The turn marker is always at the very end. */
 const TAIL_BYTES = 128 * 1024
-/** Head slice for codex's `session_meta` (line 1 — a long rollout pushes it out of the tail). */
-const HEAD_BYTES = 64 * 1024
 /** Walk depth for the codex YYYY/MM/DD tree. */
 const CODEX_WALK_DEPTH = 3
 /** How far back the FIRST sweep looks, to seed state for sessions already running when the
@@ -238,30 +237,6 @@ export class ActivityBoard {
 // The sweep
 // ─────────────────────────────────────────────────────────────────────────────
 
-function readTail(path: string): { tail: string; head: string } | null {
-  try {
-    const fd = openSync(path, 'r')
-    try {
-      const size = fstatSync(fd).size
-      if (size <= 0) return null
-      const off = Math.max(0, size - TAIL_BYTES)
-      const buf = Buffer.alloc(size - off)
-      readSync(fd, buf, 0, buf.length, off)
-      let head = ''
-      if (off > 0) {
-        const hb = Buffer.alloc(Math.min(HEAD_BYTES, off))
-        readSync(fd, hb, 0, hb.length, 0)
-        head = hb.toString('utf8')
-      }
-      return { tail: buf.toString('utf8'), head }
-    } finally {
-      closeSync(fd)
-    }
-  } catch {
-    return null
-  }
-}
-
 function safeReaddir(dir: string): string[] {
   try {
     return readdirSync(dir)
@@ -335,11 +310,11 @@ export function scanTurnStates(deps: TurnScanDeps, sinceMs: number): TurnObserva
     out.push({ ...st, personality, runtime })
   }
   for (const file of changedJsonl(deps.claudeProjectsDir, floor, 1)) {
-    const t = readTail(file)
+    const t = readSessionSlices(file, TAIL_BYTES)
     if (t) push(parseClaudeTurn(t.tail), 'claude')
   }
   for (const file of changedJsonl(deps.codexSessionsDir, floor, CODEX_WALK_DEPTH)) {
-    const t = readTail(file)
+    const t = readSessionSlices(file, TAIL_BYTES)
     if (t) push(parseCodexTurn(t.tail, t.head), 'codex')
   }
   return out

package/src/launch/ptyHost.ts

@@ -11,7 +11,7 @@
 //   - sessionAlive comes from client.ts (no @xterm);
 //   - readiness reuses paneLogViewport, whose @xterm import is dynamic and only loads flag-on.
 import { existsSync, readFileSync } from 'node:fs'
-import { deliverToHost, type DeliverResult } from '../supervisor/deliver.ts'
+import { deliverToHost, sendControlToHost, type DeliverResult } from '../supervisor/deliver.ts'
 import { attachedPath, defaultRunDir, pidPath, readGeometry } from '../supervisor/paths.ts'
 import { sessionAlive as hostDaemonAlive } from '../supervisor/client.ts'
 import { killSession as killSupervisorSession, listSessions as listSupervisorSessions } from '../supervisor/index.ts'
@@ -177,3 +177,22 @@ export async function waitHostReady(
 export function deliverHosted(identity: string, message: string, env: NodeJS.ProcessEnv = process.env): Promise<DeliverResult> {
   return deliverToHost(hostRunDir(env), identity, message)
 }
+
+/**
+ * Re-send a BARE CR to a hosted session — the submit-retry behind the landed-confirm grace
+ * (transport/index.ts). NOT a delivery: it pastes nothing and carries no payload, it only presses
+ * Enter on whatever the composer already holds.
+ *
+ * WHY THIS EXISTS. deliverToHost is paste → 300 ms settle → CR. When the paste carries attachments
+ * the receiving TUI hoists them (reads + encodes the files, rewrites the composer), and the CR fired
+ * on the fixed settle lands MID-HOIST and is swallowed — the composer keeps the envelope and NO turn
+ * is ever submitted. Proven live 16.07.2026 on an idle claude receiver: att=4 (2.7 MB) sat unsubmitted
+ * with a frozen transcript for 3m33s and moved only when an unrelated later delivery's CR arrived; the
+ * SAME envelope with an 8 s settle submitted itself in 4 s (single-factor isolation).
+ *
+ * Sent through the CONTROL channel (bare bytes, no bracketed paste) precisely because it must be a
+ * keystroke, not a pasted literal.
+ */
+export function resubmitHosted(identity: string, env: NodeJS.ProcessEnv = process.env): Promise<DeliverResult> {
+  return sendControlToHost(hostRunDir(env), identity, [Buffer.from('\r', 'utf8')])
+}

package/src/transport/index.ts

@@ -55,6 +55,7 @@ import {
   hostSessionAlive,
   hostSessionToken,
   listHostedPeers,
+  resubmitHosted,
 } from '../launch/ptyHost.ts'
 import { sendControlToHost, type DeliverResult } from '../supervisor/deliver.ts'
 // Origin-guard (docs/18) — reply-channel mechanic for agent→human sends. Lives in
@@ -183,20 +184,39 @@ const LIVENESS_POLL_MS = 100
 // deterministic fail). Prefer a false-FAIL (sender retries) over a false-OK (silent loss, forbidden).
 const CONFIRM_GRACE_MS = 4000
 
-// ATTACHMENT grace. The "sub-second" assumption above holds only WITHOUT attachments. Measured
-// 15.07.2026 on a live att=4 delivery (1.3 MB of PNGs) into an IDLE receiver: the record was
-// stamped 19:34:59.269, the confirm polled the right file until 19:35:03.4 and did not see it,
-// and the receiver's first output came at 19:35:21.7. The receiver writes the user-record when it
-// BEGINS the turn, and loading/encoding the images pushed that start ~22 s out — so a 4 s grace
-// expired on a message that had landed. Every att>0 delivery to a claude receiver false-FAILED,
-// the sender retried on the lie, and the message duplicated in the receiver's context.
+// ATTACHMENT grace. The "sub-second" assumption above holds only WITHOUT attachments: an att>0 paste
+// makes the receiving TUI hoist the files (read + encode, rewrite the composer) before any turn can
+// begin, which takes seconds.
 //
-// 60 s is a CONSERVATIVE BOUND FROM THAT MEASUREMENT (≤22 s observed, ×3 headroom), not a
-// calibrated number: the exact paste→disk latency is still unmeasured (see docs/10). It costs
-// nothing on the happy path — the confirm returns the moment the record lands — and costs the
-// sender up to a minute only when an attachment message genuinely fails, which is rare.
+// CORRECTED 16.07.2026 — the model this number was first built on was WRONG. The original note here
+// read the 15.07 att=4 measurement as "the receiver writes the user-record when it BEGINS the turn,
+// and loading the images pushed that start ~22 s out", i.e. a LATE SELF-START that a longer grace
+// would catch. A confound-free repro disproved it: att=4 (2.7 MB) into a claude receiver idle 2m17s,
+// with NOTHING else sent, left the transcript byte-frozen for 180 s — the turn NEVER started. The
+// 15.07 "22 s self-start" was almost certainly the same confound (an unrelated later delivery poked
+// the session). The real mechanism is a SWALLOWED SUBMIT, not a slow write: deliverToHost is
+// paste → 300 ms settle → CR, and with attachments the CR lands mid-hoist and is eaten. Proven by
+// single-factor isolation: the SAME envelope with an 8 s settle submitted itself in 4 s.
+//
+// So a passive grace of ANY size is useless here — it waits for a record that cannot exist, because
+// nothing was ever submitted. What makes the grace meaningful is the SUBMIT-RETRY below: we keep
+// pressing Enter while no record has landed, so the CR that falls after the hoist finishes does the
+// work. 60 s is then an upper BOUND on hoisting a large payload (not a calibrated latency), and it
+// costs nothing on the happy path — the confirm returns the moment the record lands.
 const CONFIRM_GRACE_ATTACHMENTS_MS = 60_000
 
+// Submit-retry cadence — how often, WHILE NO RECORD HAS LANDED, the grace re-presses Enter on the
+// receiver's composer (see the correction above; the primitive is ptyHost.resubmitHosted).
+//
+// WHY THIS IS SAFE. A bare CR reaches the composer in exactly one of two states: (a) it still holds
+// our unsubmitted paste — the CR submits it, which is the entire point; or (b) it is empty because
+// the turn already submitted — an empty composer ignores a CR. The loop is gated on `confirm()`
+// being false, so we stop the instant the record appears.
+//
+// Deliberately NOT every poll (100 ms): a CR is a keystroke into a live human-visible session, so it
+// is paced. 1.5 s is far below any plausible hoist time yet spaces the presses.
+const RESUBMIT_INTERVAL_MS = 1500
+
 function envNonNegative(raw: string | undefined): number | null {
   const n = raw === undefined ? NaN : Number(raw)
   return Number.isFinite(n) && n >= 0 ? n : null
@@ -246,6 +266,10 @@ export interface WarmDeliverSeam {
    *  loop (the grace is up to several seconds for codex, so a sync block would stall the whole router
    *  daemon for the duration of one delivery). */
   sleep?: (ms: number) => Promise<void>
+  /** SUBMIT-RETRY: press Enter again on the receiver's composer while no record has landed. Default:
+   *  the real `resubmitHosted` (a bare CR over the control channel). Tests inject a spy to assert the
+   *  retry fires only while unconfirmed — and never once the record is in. */
+  resubmit?: (identity: string) => Promise<void>
 }
 
 /**
@@ -357,11 +381,24 @@ async function deliverViaHost(
   // false-OK (silent loss the contract forbids).
   const confirm = seam.confirmLanded ?? ((payload: string) => transcriptCarriesEnvelope(baseline, payload, { env }))
   const sleep = seam.sleep ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)))
+  const resubmit = seam.resubmit ?? (async (identity: string) => void (await resubmitHosted(identity, env)))
   const graceMs = confirmGraceMs(envelopeHasAttachments(envelope))
   const graceDeadline = monotonicMs() + graceMs
+  // SUBMIT-RETRY (see RESUBMIT_INTERVAL_MS). deliverToHost already pressed Enter once, on a fixed
+  // settle; if the paste was still hoisting, that CR was eaten and NOTHING is running. So the grace
+  // does not merely WAIT for a record — while none has landed it keeps pressing Enter, and whichever
+  // press falls after the hoist submits the composer. Self-correcting for any payload weight: there is
+  // deliberately NO tuned "how long does hoisting take" constant anywhere in this path.
+  let nextResubmitAt = monotonicMs() + RESUBMIT_INTERVAL_MS
   while (true) {
     if (confirm(envelope)) return ok(undefined)
     if (monotonicMs() >= graceDeadline) break
+    if (monotonicMs() >= nextResubmitAt) {
+      // confirm() was false microseconds ago, so the composer still holds our paste — or the record
+      // landed in that gap and this CR meets an empty composer, which ignores it.
+      await resubmit(target.address)
+      nextResubmitAt = monotonicMs() + RESUBMIT_INTERVAL_MS
+    }
     await sleep(LIVENESS_POLL_MS)
   }
   return err(