@crouton-kit/crouter 0.3.27 → 0.3.29

package/dist/daemon/manage.js

@@ -8,6 +8,7 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { mkdirSync } from 'node:fs';
 import { crtrHome } from '../core/canvas/paths.js';
+import { hostExecPath } from '../core/runtime/branded-host.js';
 import { isDaemonRunning, readPidfile } from './crtrd.js';
 // ---------------------------------------------------------------------------
 // Entry point resolution
@@ -30,8 +31,12 @@ export function spawnDaemon() {
     }
     // Ensure the canvas home directory exists so the daemon can write its pidfile.
     mkdirSync(crtrHome(), { recursive: true });
+    // Launch from the crouter-branded host binary so the daemon shows "crouter"
+    // in macOS Full Disk Access, not "node" (see branded-host). NOTE: when crtrd
+    // is launchd-owned, the plist's ProgramArguments must point at the branded
+    // binary too — this path only covers a manual `crtr canvas daemon start`.
     const entry = resolveCrtrdEntry();
-    const child = spawn(process.execPath, [entry], {
+    const child = spawn(hostExecPath(), [entry], {
         detached: true,
         stdio: 'ignore',
     });

package/dist/index.js

@@ -10,7 +10,7 @@
 // side effects and no circular imports — keep it that way.
 // ── Runtime control ──────────────────────────────────────────────────────
 // Sanctioned launchers/mutators. reviveNode is the ONLY sanctioned launcher of
-// `pi --session`; spawnChild's host is chosen via `hostKind: 'tmux' | 'broker'`.
+// the broker engine; every node is broker-hosted (no host_kind choice).
 export { spawnChild } from './core/runtime/spawn.js';
 export { reviveNode } from './core/runtime/revive.js';
 export { closeNode } from './core/runtime/close.js';

package/dist/pi-extensions/__tests__/canvas-stophook-agentend.test.js

@@ -109,37 +109,42 @@ test('natural stop while awaiting a live worker → idle-release with NO push (n
 // ---------------------------------------------------------------------------
 // §5.1 — the §1.7 agent_end branch map on the focuses table. Every assertion is
 // on the canvas focuses/runtime rows after firing agent_end (TMUX_PANE is
-// cleared in beforeEach, so the focus helpers in the handler are pure DB and the
-// '%pane' ids below are never read by tmux). status='done' is reached by setting
-// the runtime row directly (the branch reads getNode(nodeId).status).
+// cleared in beforeEach). NOTE (broker-host cut): the placement read `focusOf`
+// used by the handler now GC-prunes a viewer row whose pane is not a LIVE tmux
+// pane (liveOrPrune → paneExists), so a fabricated '%pane' id is pruned on the
+// first read. To drive the handler's focus path deterministically in the
+// tmux-free fast tier we register viewer rows with a NULL pane (a registered-
+// but-not-yet-realized viewer, which liveOrPrune passes through). status='done'
+// is reached by setting the runtime row directly (the branch reads
+// getNode(nodeId).status).
 // ---------------------------------------------------------------------------
-test('§5.1.1 truly-done + focused + dormant idle-release manager-not-focused → MANAGER TAKEOVER of the focus row', () => {
+test('§5.1.1 truly-done + focused → focus row CLOSED, NO manager takeover (broker cut deleted handFocusToManager)', () => {
+    // Regression guard for the broker-host cut: the engine is now a detached
+    // broker, not a pane, so there is no engine to hand to a manager. The old
+    // "dormant idle-release manager takes over the finished node's focus row"
+    // path (handFocusToManager) is DELETED — a truly-done focused node just
+    // tearDownNode's its own viewer and shuts down, EVEN when a dormant
+    // idle-release manager exists (the exact case that used to trigger takeover).
     createNode(node('root', { parent: null, lifecycle: 'resident' }));
-    // mgr is dormant + idle-release — the ONLY dormant manager the daemon will
-    // revive INTO the frozen pane, so the ONLY dormant case that is a real takeover.
     createNode(node('mgr', { parent: 'root', lifecycle: 'terminal', mode: 'orchestrator', status: 'idle', intent: 'idle-release' }));
-    // M starts WITH a recorded LOCATION so the MINOR presence-null is observable.
+    // M starts WITH a recorded LOCATION so the done-path presence-null is observable.
     createNode(node('M', { parent: 'mgr', lifecycle: 'terminal', pane: '%m', tmux_session: 'Suser', window: '@wm' }));
     subscribe('mgr', 'M', true);
-    openFocusRow('fM', '%m', 'Suser', 'M');
+    openFocusRow('fM', null, 'Suser', 'M'); // null pane → focusOf returns it → drives tearDownNode
     process.env['CRTR_NODE_ID'] = 'M';
     setStatus('M', 'done'); // pushed final this turn
     const pi = makeFakePi();
     registerCanvasStophook(pi);
     let shutdown = false;
     pi.fire('agent_end', stopEvent('done — pushed final'), { shutdown: () => { shutdown = true; } });
-    // managerId = M.parent = 'mgr' (idle-release, not focused elsewhere, no live
-    // pane here → the DORMANT-takeover path) → handFocusToManager repoints fM's
-    // occupant M→mgr (true ONLY because mgr is idle+idle-release). The
-    // daemon later revives mgr INTO M's frozen focus pane. Non-vacuous: a no-op (no
-    // handoff) impl leaves M as occupant, so getFocusByNode('mgr') is null AND
-    // getFocusByNode('M') still names fM — both asserts fail.
-    assert.equal(getFocusByNode('mgr')?.focus_id, 'fM', 'focus row taken over by the manager');
+    // The done branch: focusOf('M') != null → tearDownNode('M') CLOSES fM. The
+    // manager is NOT handed anything (takeover deleted). Non-vacuous: a takeover
+    // impl would leave getFocusByNode('mgr').focus_id === 'fM'.
+    assert.equal(getFocusByNode('mgr'), null, 'the manager is NOT handed the finished node\'s focus (takeover deleted)');
+    assert.equal(getFocusById('fM'), null, 'the finished node\'s viewer focus row is closed');
     assert.equal(getFocusByNode('M'), null, 'the finished node no longer occupies any focus');
-    assert.equal(shutdown, true, 'pi shut down after the handoff');
-    // MINOR: after a successful takeover M (done) owns no pane (Invariant P) — its
-    // own presence is nulled so two rows never reference %m. Non-vacuous: an impl
-    // that skips the done-path setPresence-null leaves getNode('M').pane === '%m'.
+    assert.equal(shutdown, true, 'pi shut down after teardown');
+    // The done node's own presence is nulled (setPresence(null) on the done path).
     assert.equal(getNode('M')?.pane ?? null, null, 'the finished node\'s own LOCATION pane is nulled');
     assert.equal(getNode('M')?.window ?? null, null, 'the finished node\'s window presence is nulled too');
 });
@@ -206,7 +211,10 @@ test('§5.1.5 awaiting + FOCUSED → STAY ALIVE: pi keeps running (no release),
     createNode(node('worker', { parent: 'mgr', lifecycle: 'terminal', status: 'active' }));
     subscribe('root', 'mgr', true);
     subscribe('mgr', 'worker', true); // mgr awaits a live worker → would idle-release if UNfocused
-    openFocusRow('fMgr', '%g', 'Suser', 'mgr');
+    // null pane (broker cut): focusOf passes a null-pane viewer row through, so the
+    // handler reads mgr as FOCUSED in the tmux-free fast tier (a fabricated %pane
+    // would be GC-pruned by liveOrPrune and the node would wrongly release).
+    openFocusRow('fMgr', null, 'Suser', 'mgr');
     process.env['CRTR_NODE_ID'] = 'mgr';
     const pi = makeFakePi();
     registerCanvasStophook(pi);

package/dist/pi-extensions/canvas-context-intro.js

@@ -15,11 +15,11 @@
 //
 // The block carries: the path to the node's own context dir and the framing for
 // what belongs there (a shared document store for the other nodes). EVERY node
-// also gets a `<references>` block rendered from the document substrate —
-// eligible `reference` docs at their system-prompt visibility rung, plus the
+// also gets a `<knowledge>` block rendered from the document substrate —
+// eligible `knowledge` docs at their system-prompt visibility rung, plus the
 // node's own node-local substrate docs — so the bearings name what to read on
-// demand. (Skills and preferences surface as their own `<skills>` /
-// `<preferences>` blocks of the system prompt, not in this block.) An
+// demand. (Preferences surface as their own `<preferences>` block of the
+// system prompt, not in this block.) An
 // orchestrator additionally gets the across-refresh-cycles framing (the one
 // thing a terminal worker's bearings drop). The prose lives in
 // core/runtime/bearings.ts (shared with the promotion guidance dump).

package/dist/pi-extensions/canvas-doc-substrate.js

@@ -9,13 +9,13 @@
 // It owns the substrate's two new pi hooks:
 //
 //   1. before_agent_start — the BOOT system-prompt half. Splices the rendered
-//      `<skills>` + `<preferences>` + `<memory-guidance>` blocks into
-//      `event.systemPrompt`, right after pi's native "Available tools" list
-//      (before the `\n\nGuidelines:`
-//      anchor), so the substrate's skills/preferences sit in the tool-selection
-//      frame the agent reads while choosing a capability — mirroring the
-//      personal crouter-help.ts anchor logic. Falls back to appending when the
-//      anchor is absent.
+//      `<preferences>` + `<memory-guidance>` blocks into `event.systemPrompt`,
+//      right after pi's native "Available tools" list (before the
+//      `\n\nGuidelines:` anchor), so the substrate's standing directives sit in
+//      the tool-selection frame the agent reads while choosing a capability —
+//      mirroring the personal crouter-help.ts anchor logic. Falls back to
+//      appending when the anchor is absent. (Knowledge rides the `<crtr-context>`
+//      bearings message instead — see core/substrate/render.ts.)
 //
 //   2. tool_result (gated on `read`) — the ON-READ half. For each non-error
 //      `read`, surfaces the substrate docs that should appear alongside the file
@@ -34,8 +34,9 @@
 // with no dep on the pi packages. Mirrors canvas-context-intro.ts.
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
-import { renderMemoryGuidance, renderOnReadDocs, renderPreferencesSection, renderSkillsSection, } from '../core/substrate/index.js';
+import { renderMemoryGuidance, renderOnReadDocs, renderPreferencesSection, } from '../core/substrate/index.js';
 import { clearSessionCache } from '../core/substrate/session-cache.js';
+import { loadInjectedDocs, saveInjectedDocs } from '../core/substrate/injected-store.js';
 // ---------------------------------------------------------------------------
 // Extension
 // ---------------------------------------------------------------------------
@@ -55,24 +56,29 @@ export function registerCanvasDocSubstrate(pi) {
     const nodeId = process.env['CRTR_NODE_ID'];
     if (nodeId === undefined || nodeId.trim() === '')
         return; // not a canvas node — inert
-    // Per-session set of injected doc realpaths → a doc surfaces at most once per
-    // session across repeated reads. Cleared on every session_start (so a resume
-    // starts fresh, matching the on-read precedent).
-    // Also clears the per-session substrate parse cache so the corpus is re-scanned
-    // fresh for each new session (avoids stale docs after a skill/memory write).
-    const injectedDocs = new Set();
+    // Per-TRANSCRIPT set of injected doc realpaths → a doc surfaces at most once
+    // across the node's conversation, EVEN across a dormancy → revive(resume)
+    // cycle. A resume reuses the same .jsonl transcript in a NEW pi process, so
+    // the set is REHYDRATED from disk at process start (not started empty) and is
+    // NOT cleared on session_start — a resume continues the transcript, so the
+    // dedup must carry forward. The one launch path that begins a FRESH transcript
+    // (reviveNode with resume=false) deletes the file, so a new conversation
+    // rehydrates empty here. See core/substrate/injected-store.ts.
+    const injectedDocs = loadInjectedDocs(nodeId);
     pi.on('session_start', () => {
-        injectedDocs.clear();
+        // Only the per-session substrate PARSE cache resets each session (so the
+        // corpus is re-scanned, picking up skill/memory writes). injectedDocs is
+        // transcript-scoped, not session-scoped — deliberately NOT cleared here.
         clearSessionCache();
     });
-    // 1. BOOT system-prompt half — splice `<skills>` + `<preferences>` +
-    //    `<memory-guidance>`. The guidance block is always present for a canvas
-    //    node (the memory system always exists), so the splice is never empty even
-    //    when both trees are.
+    // 1. BOOT system-prompt half — splice `<preferences>` + `<memory-guidance>`.
+    //    The guidance block is always present for a canvas node (the memory system
+    //    always exists), so the splice is never empty even when the preferences
+    //    tree is. (Knowledge no longer enters the system prompt — it rides the
+    //    `<crtr-context>` bearings message via renderKnowledgeBlock.)
     pi.on('before_agent_start', (event) => {
         try {
             const sections = [
-                renderSkillsSection(nodeId),
                 renderPreferencesSection(nodeId),
                 renderMemoryGuidance(),
             ].filter((s) => s !== '');
@@ -109,6 +115,9 @@ export function registerCanvasDocSubstrate(pi) {
             const injected = renderOnReadDocs(nodeId, absFile, injectedDocs);
             if (injected === '')
                 return; // nothing surfaced — pass the read through unchanged
+            // A doc surfaced → renderOnReadDocs grew injectedDocs; persist the set so
+            // the dedup survives a later dormancy → revive(resume).
+            saveInjectedDocs(nodeId, injectedDocs);
             // Prepend the surfacing docs ahead of the file contents.
             return { content: [{ type: 'text', text: injected }, ...event.content] };
         }