@crouton-kit/crouter 0.3.29 → 0.3.31

package/dist/build-root.d.ts

@@ -1,8 +1,16 @@
 import type { RootDef } from './core/command.js';
-/** Assemble the full crtr command tree. Root owns only the tagline; every
- *  subtree declares its own root representation via its rootEntry, and every
- *  branch assembles its child listing from the child defs (each child owns its
- *  description/whenToUse/tier). No globals: -h is taught by each child's
- *  whenToUse CTA and the capability-discovery rule in the root footer, so a
- *  standalone "-h: print help" stub would be redundant. */
-export declare function buildRoot(): RootDef;
+/** Every shipped subtree name. Cheap (no module loading) — the front-door
+ *  recursion guard and the dispatcher's first-token routing need only names. */
+export declare const SUBTREE_NAMES: string[];
+/** Build a root that contains only the subtree `first` dispatches into.
+ *  Returns the FULL root when `first` is not a recognized subtree — bare `crtr`,
+ *  `-h`/`--help`, `--version`, and any unknown leading token all need the
+ *  complete tree (root -h lists every subtree; the unknown-path error names
+ *  every valid child). This keeps every help/error surface byte-identical while
+ *  the common leaf-dispatch path loads exactly one subtree. */
+export declare function resolveRoot(first: string | undefined): Promise<RootDef>;
+/** Assemble the full crtr command tree (all subtrees). Used for root -h, the
+ *  unknown-path error, bare-root boot, and the listing-completeness test. Root
+ *  owns only the tagline; every subtree declares its own root representation via
+ *  its rootEntry. */
+export declare function buildRoot(): Promise<RootDef>;

package/dist/build-root.js

@@ -1,38 +1,50 @@
 import { defineRoot } from './core/command.js';
-import { registerMemory } from './commands/memory.js';
-import { registerPkg } from './commands/pkg.js';
-import { registerHuman } from './commands/human.js';
-import { registerSys } from './commands/sys.js';
-import { registerPush, registerFeed } from './commands/push.js';
-import { registerNode } from './commands/node.js';
-import { registerCanvas } from './commands/canvas.js';
-import { registerView } from './commands/view.js';
-import { registerAttach } from './clients/attach/attach-cmd.js';
-import { registerWorkspace } from './commands/workspace.js';
-import { registerWeb } from './clients/web/web-cmd.js';
-/** Assemble the full crtr command tree. Root owns only the tagline; every
- *  subtree declares its own root representation via its rootEntry, and every
- *  branch assembles its child listing from the child defs (each child owns its
- *  description/whenToUse/tier). No globals: -h is taught by each child's
- *  whenToUse CTA and the capability-discovery rule in the root footer, so a
- *  standalone "-h: print help" stub would be redundant. */
-export function buildRoot() {
-    return defineRoot({
-        tagline: 'crtr: agentic planning runtime.',
-        globals: [],
-        subtrees: [
-            registerMemory(),
-            registerPkg(),
-            registerHuman(),
-            registerSys(),
-            registerNode(),
-            registerPush(),
-            registerFeed(),
-            registerCanvas(),
-            registerView(),
-            registerAttach(),
-            registerWorkspace(),
-            registerWeb(),
-        ],
-    });
+const TAGLINE = 'crtr: agentic planning runtime.';
+/** Lazy registry: subtree name → dynamic importer that builds its BranchDef.
+ *  The whole point is that each `import()` only compiles that one subtree's
+ *  module graph. The hot path (`crtr node focus …`, `crtr feed`, …) dispatches
+ *  into a single leaf, so it must load ONE subtree — not the attach-TUI
+ *  (babel/highlight.js), the web/vite command, and every other subtree it never
+ *  touches. `crtr` cold-start is dominated by Node module loading; keeping the
+ *  other 11 subtrees off the path is the biggest, lowest-risk win.
+ *
+ *  Naming note: `push` and `feed` are two subtrees from one module — importing
+ *  it once yields both registers. */
+const SUBTREE_LOADERS = {
+    memory: async () => (await import('./commands/memory.js')).registerMemory(),
+    pkg: async () => (await import('./commands/pkg.js')).registerPkg(),
+    human: async () => (await import('./commands/human.js')).registerHuman(),
+    sys: async () => (await import('./commands/sys.js')).registerSys(),
+    node: async () => (await import('./commands/node.js')).registerNode(),
+    push: async () => (await import('./commands/push.js')).registerPush(),
+    feed: async () => (await import('./commands/push.js')).registerFeed(),
+    canvas: async () => (await import('./commands/canvas.js')).registerCanvas(),
+    view: async () => (await import('./commands/view.js')).registerView(),
+    attach: async () => (await import('./clients/attach/attach-cmd.js')).registerAttach(),
+    workspace: async () => (await import('./commands/workspace.js')).registerWorkspace(),
+    web: async () => (await import('./clients/web/web-cmd.js')).registerWeb(),
+};
+/** Every shipped subtree name. Cheap (no module loading) — the front-door
+ *  recursion guard and the dispatcher's first-token routing need only names. */
+export const SUBTREE_NAMES = Object.keys(SUBTREE_LOADERS);
+/** Build a root that contains only the subtree `first` dispatches into.
+ *  Returns the FULL root when `first` is not a recognized subtree — bare `crtr`,
+ *  `-h`/`--help`, `--version`, and any unknown leading token all need the
+ *  complete tree (root -h lists every subtree; the unknown-path error names
+ *  every valid child). This keeps every help/error surface byte-identical while
+ *  the common leaf-dispatch path loads exactly one subtree. */
+export async function resolveRoot(first) {
+    const loader = first !== undefined ? SUBTREE_LOADERS[first] : undefined;
+    if (loader !== undefined) {
+        return defineRoot({ tagline: TAGLINE, globals: [], subtrees: [await loader()] });
+    }
+    return buildRoot();
+}
+/** Assemble the full crtr command tree (all subtrees). Used for root -h, the
+ *  unknown-path error, bare-root boot, and the listing-completeness test. Root
+ *  owns only the tagline; every subtree declares its own root representation via
+ *  its rootEntry. */
+export async function buildRoot() {
+    const subtrees = await Promise.all(SUBTREE_NAMES.map((n) => SUBTREE_LOADERS[n]()));
+    return defineRoot({ tagline: TAGLINE, globals: [], subtrees });
 }

package/dist/cli.js

@@ -1,25 +1,30 @@
 #!/usr/bin/env node
 import { runCli } from './core/command.js';
-import { buildRoot } from './build-root.js';
+import { resolveRoot } from './build-root.js';
 import { maybeBootRoot } from './core/runtime/front-door.js';
 import { maybeAutoUpdate } from './core/auto-update.js';
 import { ensureOfficialMarketplace, ensureProjectScope } from './core/bootstrap.js';
 import { provisionExports } from './core/skill-sync/export.js';
-// The full command tree is assembled in build-root.ts (shared with the
-// listing-completeness test). Root owns only the tagline; every subtree
-// declares its own representation.
-const root = buildRoot();
-// The front door: bare `crtr` (or `crtr [dir] ["prompt"]`) boots a resident
-// root node and execs pi in this terminal. Recognized subcommands fall through
-// to the normal dispatcher. Must run before anything that assumes a subcommand.
-if (maybeBootRoot(root, process.argv)) {
-    // bootRoot exec'd pi inline and exited; unreachable.
+async function main() {
+    // Lazy command tree: load only the subtree this invocation dispatches into.
+    // resolveRoot returns the full tree only for help/version/bare/unknown, where
+    // every subtree is genuinely needed (root -h, the unknown-path error). The
+    // hot leaf-dispatch path loads one subtree, keeping the other 11 (and their
+    // heavy deps — the attach TUI, web/vite) off cold-start.
+    const root = await resolveRoot(process.argv[2]);
+    // The front door: bare `crtr` (or `crtr [dir] ["prompt"]`) boots a resident
+    // root node and execs pi in this terminal. Recognized subcommands fall through
+    // to the normal dispatcher. Must run before anything that assumes a subcommand.
+    if (maybeBootRoot(root, process.argv)) {
+        // bootRoot exec'd pi inline and exited; unreachable.
+    }
+    ensureOfficialMarketplace(process.argv);
+    provisionExports(root);
+    ensureProjectScope(process.argv);
+    maybeAutoUpdate(process.argv);
+    await runCli(root, process.argv);
 }
-ensureOfficialMarketplace(process.argv);
-provisionExports(root);
-ensureProjectScope(process.argv);
-maybeAutoUpdate(process.argv);
-runCli(root, process.argv).catch((err) => {
+main().catch((err) => {
     const msg = err instanceof Error ? err.message : String(err);
     process.stderr.write(`crtr: ${msg}\n`);
     process.exit(1);

package/dist/clients/attach/__tests__/editor-newline.test.js

@@ -1,15 +1,19 @@
-// Regression: in the attach viewer, Alt+Enter did NOTHING — not a newline, not a
-// submit. The editor was SWALLOWING it. Root cause: pi-coding-agent's
+// Regression (#11): in the attach viewer, Alt+Enter did NOTHING on an INSTALLED
+// (non-deduped) crtr — not a newline, not a submit. Root cause: pi-coding-agent's
 // CustomEditor resolves `@earendil-works/pi-tui` from its OWN node_modules, a
-// SEPARATE module instance from the one `config-load` imports (a non-deduped
-// install). config-load registered the KeybindingsManager only on its copy, but
-// the editor's super reads `getKeybindings()` from ITS instance — stuck at the
-// default `tui.input.newLine = shift+enter`. So the attach `alt+enter → newLine`
-// binding was invisible to the editor: Alt+Enter (`\x1b[13;3u`) matched neither
-// newLine nor submit and fell through. `mirrorKeybindingsToEditor` registers the
-// SAME manager on the editor's pi-tui instance; this test feeds the exact
-// Alt+Enter / Enter byte sequences a terminal sends and asserts the behavior.
-// See mirrorKeybindingsToEditor in src/clients/attach/config-load.ts.
+// SEPARATE module instance from the one `config-load` imports. The base Editor
+// reads `getKeybindings()` from THAT instance — stuck at the default
+// `tui.input.newLine = shift+enter` unless the `mirrorKeybindingsToEditor` shim
+// (best-effort, `import.meta.resolve`-based) succeeds in registering crtr's
+// manager on it. On install layouts where that mirror silently fails, the
+// `alt+enter → newLine` override never reached the editor and Alt+Enter
+// (`\x1b[13;3u`) matched neither newLine nor submit and fell through.
+//
+// The fix makes the chord self-contained: `TitledEditor.handleInput` matches
+// newLine against crtr's OWN KeybindingsManager (the one CustomEditor already
+// uses for `app.*`) and inserts the newline directly, so it no longer depends on
+// the cross-instance mirror. The third test below builds the editor WITHOUT the
+// mirror and is the real guard for the installed-layout failure.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { mkdtempSync } from 'node:fs';
@@ -26,7 +30,7 @@ async function buildEditor() {
     // attach DEFAULT (`ATTACH_KEYBINDING_OVERRIDES` adds alt+enter to newLine).
     const agentDir = mkdtempSync(join(tmpdir(), 'crtr-kb-'));
     const km = createKeybindingsManager(agentDir);
-    await mirrorKeybindingsToEditor(km); // the fix
+    await mirrorKeybindingsToEditor(km); // mirror still runs for general tui.* parity
     const tui = new TUI(new ProcessTerminal());
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     return new TitledEditor(tui, { borderColor: (s) => s, selectList: {} }, km, {
@@ -55,3 +59,24 @@ test('attach editor still submits on plain Enter', async () => {
     assert.equal(submitted, 'hello', 'plain Enter must submit');
     assert.equal(editor.getText(), '', 'editor clears after submit');
 });
+test('attach editor inserts a newline on Alt+Enter even WITHOUT the cross-instance mirror (#11)', async () => {
+    // Reproduces the installed-layout failure: the editor's pi-tui instance never
+    // received crtr's alt+enter override (mirror not run). TitledEditor.handleInput
+    // must still newline by matching crtr's own km directly.
+    const agentDir = mkdtempSync(join(tmpdir(), 'crtr-kb-'));
+    const km = createKeybindingsManager(agentDir);
+    // NOTE: deliberately NOT calling mirrorKeybindingsToEditor.
+    const tui = new TUI(new ProcessTerminal());
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const editor = new TitledEditor(tui, { borderColor: (s) => s, selectList: {} }, km, {
+        paddingX: 1,
+    });
+    let submitted = null;
+    editor.onSubmit = (t) => {
+        submitted = t;
+    };
+    editor.setText('hello');
+    editor.handleInput(ALT_ENTER);
+    assert.equal(editor.getText(), 'hello\n', 'Alt+Enter must newline without relying on the mirror');
+    assert.equal(submitted, null, 'Alt+Enter must not submit');
+});

package/dist/clients/attach/attach-cmd.js

@@ -31,7 +31,7 @@ import { writeClipboardText } from './clipboard-text.js';
 import { buildCanvasPanelLines } from './canvas-panels.js';
 import { GraphOverlay } from './graph-overlay.js';
 import { slashCommandList } from './slash-commands.js';
-import { applyTheme, attachPalette, createKeybindingsManager, defaultAgentDir, mirrorKeybindingsToEditor, mirrorKittyProtocolToEditor, } from './config-load.js';
+import { applyTheme, attachPalette, createKeybindingsManager, defaultAgentDir, mirrorKeybindingsToEditor, mirrorKittyProtocolToEditor, resolveFdPath, } from './config-load.js';
 import { buildLoginPicker, buildLogoutPicker } from './auth-pickers.js';
 import { TitledEditor, thinkingBorderColor, thinkingTitleStyle, defaultTitleStyle } from './titled-editor.js';
 import { fetchGitInfo } from './git-info.js';
@@ -134,6 +134,11 @@ async function runAttach(nodeId, observer) {
     // deduped install. Awaited before tui.start so the editor never handles a key
     // against stale defaults.
     await mirrorKeybindingsToEditor(km);
+    // Resolve `fd` once so the editor's @-mention picker can list files. pi-tui's
+    // CombinedAutocompleteProvider yields zero file suggestions without it (issue
+    // #6); `null` on a host with no fd (and no download) just leaves @-mention
+    // file-less, matching pi's own degraded behavior.
+    const fdPath = await resolveFdPath();
     // The front door installs the Alt+C menu binding before it ever loads a theme,
     // so it lands unstyled. Now that this viewer process HAS themed (applyTheme
     // above populated the live-theme global), re-install it so the menu picks up
@@ -170,7 +175,7 @@ async function runAttach(nodeId, observer) {
     // Slash-command autocomplete: builtins + native canvas commands now; enriched
     // with the broker's engine/extension/skill commands on the get_commands ack.
     const setCommands = (commands) => {
-        editor.setAutocompleteProvider(new CombinedAutocompleteProvider(slashCommandList(commands), meta.cwd));
+        editor.setAutocompleteProvider(new CombinedAutocompleteProvider(slashCommandList(commands), meta.cwd, fdPath));
     };
     setCommands();
     // 3. Render layer (T5). ChatView owns the chat scroll + activity spinner; the
@@ -182,6 +187,9 @@ async function runAttach(nodeId, observer) {
     let role = observer ? 'observer' : 'controller';
     let brokerAgentDir;
     let liveState;
+    // Shell/bash mode: the editor text leads with `!`. Tracks pi's interactive
+    // `isBashMode`, which recolors the editor border green as a visual cue (#7).
+    let bashMode = false;
     let notice = '';
     // Live context occupancy for the footer: `contextTokens` is the prompt-token
     // count of the most recent assistant turn (input + cacheRead + cacheWrite =
@@ -365,16 +373,38 @@ async function runAttach(nodeId, observer) {
     // routing (T6) reads `state.isStreaming`, so this must stay current — the
     // broker only ships full state in `welcome`, so we patch isStreaming/name/etc
     // from the relayed event stream below.
+    // Paint the editor border + title chip. Shell/bash mode (leading `!`) wins and
+    // forces the whole frame green (#7); otherwise the hue tracks the thinking
+    // level. One place so the onChange bash toggle and live-state updates agree.
+    const paintEditorFrame = () => {
+        if (bashMode) {
+            editor.borderColor = pal.bashMode;
+            editor.titleStyle = (s) => `\x1b[42m\x1b[97m\x1b[1m ${s} \x1b[0m`;
+        }
+        else {
+            editor.borderColor = thinkingBorderColor(liveState?.thinkingLevel, pal.border);
+            // Title chip background = the same thinking-level color (bold white text),
+            // so the name chip and the border rule read as one hue.
+            editor.titleStyle = thinkingTitleStyle(liveState?.thinkingLevel, defaultTitleStyle);
+        }
+    };
+    // Recolor the editor when `!` enters/leaves the front of the input (#7). pi's
+    // interactive mode does the same off `editor.onChange`.
+    editor.onChange = (text) => {
+        const next = text.trimStart().startsWith('!');
+        if (next === bashMode)
+            return;
+        bashMode = next;
+        paintEditorFrame();
+        tui.requestRender();
+    };
     const setLiveState = (state) => {
         liveState = state;
         input.setState(state);
         // The session name lives in the editor's top border (solid chip); the border
         // color tracks the agent's thinking level. Both follow live state.
         editor.title = state.sessionName ? `⬢ ${state.sessionName}` : '';
-        editor.borderColor = thinkingBorderColor(state.thinkingLevel, pal.border);
-        // Title chip background = the same thinking-level color (bold white text), so
-        // the name chip and the border rule read as one hue.
-        editor.titleStyle = thinkingTitleStyle(state.thinkingLevel, defaultTitleStyle);
+        paintEditorFrame();
         renderFooter();
         // Panel liveness rides the relayed event stream (agent_start/agent_end/
         // queue_update/session_info_changed all patch state through here) plus the

package/dist/clients/attach/config-load.d.ts

@@ -16,6 +16,7 @@ export declare function mirrorKeybindingsToEditor(km: KeybindingsManager): Promi
  *  instance (ProcessTerminal sets it only on OUR copy). Call after the terminal
  *  has negotiated, i.e. after `tui.start()`. */
 export declare function mirrorKittyProtocolToEditor(active: boolean): Promise<void>;
+export declare function resolveFdPath(): Promise<string | null>;
 /**
  * The user's theme name from pi settings — project (`<cwd>/.pi/settings.json`)
  * overrides global (`~/.pi/agent/settings.json`). `undefined` → pi's default.
@@ -62,6 +63,11 @@ export interface AttachPalette {
     error: (s: string) => string;
     /** Warning / transient notices. Same constraint as `error` → ANSI yellow. */
     warning: (s: string) => string;
+    /** Editor border when the input is in shell/bash mode (leading `!`). pi paints
+     *  this from its `bashMode` theme color (default `green`), which pi does NOT
+     *  re-export through its public surface — so, like `error`/`warning`, this is
+     *  the semantically-correct ANSI green, not an ad-hoc hardcode. */
+    bashMode: (s: string) => string;
 }
 /**
  * Build the attach chrome's color palette from the LIVE theme. Call AFTER

package/dist/clients/attach/config-load.js

@@ -144,6 +144,37 @@ export async function mirrorKeybindingsToEditor(km) {
 export async function mirrorKittyProtocolToEditor(active) {
     (await editorPiTui())?.setKittyProtocolActive(active);
 }
+/**
+ * Resolve the `fd` binary path the @-mention file picker needs. pi-tui's
+ * `CombinedAutocompleteProvider` only returns file suggestions when handed an
+ * `fdPath` (its third ctor arg) — without it, typing `@` triggers the picker but
+ * `getFuzzyFileSuggestions` returns `[]`, so the picker never appears (issue #6).
+ * pi's own interactive mode resolves this via `ensureTool('fd')` from its
+ * internal `utils/tools-manager` (checks pi's managed bin dir + system PATH,
+ * downloading the binary if missing). That module is NOT on pi-coding-agent's
+ * `.`-only export map, so we reach it the same way we reach the editor's pi-tui
+ * instance: resolve the package entry, then import the sibling file by URL
+ * (file URLs bypass the bare-specifier exports gate). Best-effort: any
+ * resolution/import failure (or no fd available) → `null`, and the picker stays
+ * file-less rather than crashing.
+ */
+let fdPathPromise;
+export function resolveFdPath() {
+    if (!fdPathPromise) {
+        fdPathPromise = (async () => {
+            try {
+                const pcaEntry = import.meta.resolve('@earendil-works/pi-coding-agent');
+                const toolsManagerUrl = new URL('./utils/tools-manager.js', pcaEntry).href;
+                const toolsManager = (await import(toolsManagerUrl));
+                return (await toolsManager.ensureTool('fd', true)) ?? null;
+            }
+            catch {
+                return null;
+            }
+        })();
+    }
+    return fdPathPromise;
+}
 /**
  * The user's theme name from pi settings — project (`<cwd>/.pi/settings.json`)
  * overrides global (`~/.pi/agent/settings.json`). `undefined` → pi's default.
@@ -174,6 +205,7 @@ export function applyTheme(opts) {
 const FAINT = (s) => `\x1b[2m${s}\x1b[22m`;
 const RED = (s) => `\x1b[31m${s}\x1b[39m`;
 const YELLOW = (s) => `\x1b[33m${s}\x1b[39m`;
+const GREEN = (s) => `\x1b[32m${s}\x1b[39m`;
 /**
  * Build the attach chrome's color palette from the LIVE theme. Call AFTER
  * `applyTheme()` — the colors are pulled from pi's `getMarkdownTheme()` /
@@ -204,6 +236,7 @@ export function attachPalette() {
         bold: md.bold,
         error: RED,
         warning: YELLOW,
+        bashMode: GREEN,
         surface: (line) => `${bgOn}${line.replace(/\x1b\[0m/g, `\x1b[0m${bgOn}`)}\x1b[49m`,
     };
 }

package/dist/clients/attach/titled-editor.d.ts

@@ -1,4 +1,5 @@
 import { CustomEditor } from '@earendil-works/pi-coding-agent';
+import { type EditorOptions, type EditorTheme, type TUI } from '@earendil-works/pi-tui';
 /** Thinking levels pi cycles through (shift+tab), lowest → highest budget. */
 export type ThinkingLevel = 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
 /** The default (thinking `off`) title chip: reverse video + a space of padding
@@ -20,6 +21,23 @@ export declare function thinkingTitleStyle(level: string | undefined, fallback:
  *  regression test. */
 export declare function composeTopBorder(width: number, title: string, info: string, titleStyle: (s: string) => string, borderColor: (s: string) => string): string;
 export declare class TitledEditor extends CustomEditor {
+    /** crtr's OWN keybindings manager — the same one CustomEditor matches `app.*`
+     *  against. We keep a reference so `handleInput` can resolve the newline chord
+     *  here, independent of the editor's (possibly separate) pi-tui module global. */
+    private readonly km;
+    constructor(tui: TUI, theme: EditorTheme, keybindings: ConstructorParameters<typeof CustomEditor>[2], options?: EditorOptions);
+    /** Insert a newline on the newLine chord (Alt+Enter / Shift+Enter) using crtr's
+     *  OWN keybindings manager, then defer everything else to the stock editor.
+     *
+     *  The base `Editor` resolves newLine against `getKeybindings()` on ITS pi-tui
+     *  instance, which in a non-deduped install is a DIFFERENT module than the one
+     *  carrying crtr's `alt+enter` override — so the override can silently never
+     *  reach it and Alt+Enter falls through to submit (issue #11). crtr's `km` (the
+     *  same manager CustomEditor matches `app.*` against) always carries the
+     *  override, so matching the chord here makes the newline behavior independent
+     *  of cross-instance keybinding mirroring. Skipped while the autocomplete popup
+     *  is open so Enter-to-confirm keeps working. */
+    handleInput(data: string): void;
     /** Session-name chip painted into the LEFT of the top border. Empty → plain. */
     title: string;
     /** Pre-styled context string painted into the RIGHT of the top border (cwd /

package/dist/clients/attach/titled-editor.js

@@ -6,21 +6,23 @@
 //      on each state update), mirroring pi's `getThinkingBorderColor`.
 // Both are pure render-layer chrome; nothing here touches the socket or session.
 import { CustomEditor } from '@earendil-works/pi-coding-agent';
-import { truncateToWidth, visibleWidth } from '@earendil-works/pi-tui';
-/** Per-level border/chip color as a 24-bit RGB triple — ONE blue-violet hue at
- *  CONSTANT perceived lightness (luma ≈ 120) whose SATURATION alone climbs with
- *  the budget: a near-gray blue at `minimal` deepening to a vivid violet at
- *  `xhigh`, never getting lighter or darker — only more colorful. (pi paints its
- *  own `thinking*` theme colors off its public palette surface, so we own this
- *  ramp directly — truecolor, not the 16-color ANSI hues, so the saturation
- *  climb actually reads.) `off` falls back to the caller's default border color. */
+import { truncateToWidth, visibleWidth, } from '@earendil-works/pi-tui';
+/** Per-level border/chip color as a 24-bit RGB triple. Each level ROTATES HUE by
+ *  a large step (~35–45°) along a "heat" ramp — indigo → violet → magenta → pink
+ *  → red-orange — so adjacent levels are unmistakably different at a glance (a
+ *  constant-hue saturation climb read as nearly identical; see #8). All sit at
+ *  roughly constant, high-ish lightness so each is vivid on a dark terminal, and
+ *  the cool→hot direction maps intuitively onto a climbing thinking budget. (pi
+ *  paints its own `thinking*` theme colors off its public palette surface, so we
+ *  own this ramp directly — truecolor, not the 16-color ANSI hues, so the hue
+ *  sweep actually reads.) `off` falls back to the caller's default border color. */
 const THINKING_RGB = {
     off: undefined, // default border color
-    minimal: [125, 115, 135], // near-gray blue-violet
-    low: [129, 109, 151], // muted blue-violet
-    medium: [134, 103, 168], // violet
-    high: [139, 98, 184], // deeper violet
-    xhigh: [144, 92, 200], // vivid violet
+    minimal: [96, 132, 220], // indigo / cornflower blue
+    low: [150, 110, 214], // violet
+    medium: [200, 98, 196], // magenta
+    high: [224, 102, 142], // pink-red
+    xhigh: [228, 120, 84], // red-orange
 };
 /** The default (thinking `off`) title chip: reverse video + a space of padding
  *  each side, so the name reads as a label sitting on the border rule. Used as
@@ -63,6 +65,35 @@ export function composeTopBorder(width, title, info, titleStyle, borderColor) {
     return chip + borderColor('─'.repeat(fill)) + infoChip;
 }
 export class TitledEditor extends CustomEditor {
+    /** crtr's OWN keybindings manager — the same one CustomEditor matches `app.*`
+     *  against. We keep a reference so `handleInput` can resolve the newline chord
+     *  here, independent of the editor's (possibly separate) pi-tui module global. */
+    km;
+    // CustomEditor's ctor signature; captured so we own the newline chord (see
+    // handleInput). The keybindings param is typed as pi's app-subclass manager,
+    // but the attach viewer feeds it pi-tui's base manager — hence the cast.
+    constructor(tui, theme, keybindings, options) {
+        super(tui, theme, keybindings, options);
+        this.km = keybindings;
+    }
+    /** Insert a newline on the newLine chord (Alt+Enter / Shift+Enter) using crtr's
+     *  OWN keybindings manager, then defer everything else to the stock editor.
+     *
+     *  The base `Editor` resolves newLine against `getKeybindings()` on ITS pi-tui
+     *  instance, which in a non-deduped install is a DIFFERENT module than the one
+     *  carrying crtr's `alt+enter` override — so the override can silently never
+     *  reach it and Alt+Enter falls through to submit (issue #11). crtr's `km` (the
+     *  same manager CustomEditor matches `app.*` against) always carries the
+     *  override, so matching the chord here makes the newline behavior independent
+     *  of cross-instance keybinding mirroring. Skipped while the autocomplete popup
+     *  is open so Enter-to-confirm keeps working. */
+    handleInput(data) {
+        if (!this.isShowingAutocomplete() && this.km.matches(data, 'tui.input.newLine')) {
+            this.insertTextAtCursor('\n');
+            return;
+        }
+        super.handleInput(data);
+    }
     /** Session-name chip painted into the LEFT of the top border. Empty → plain. */
     title = '';
     /** Pre-styled context string painted into the RIGHT of the top border (cwd /

package/dist/commands/chord.js

@@ -8,8 +8,7 @@
 // `crtr <argv>`. This keeps the menu static while the behaviour stays fully
 // config-driven (no per-node menu rebuild).
 //
-// Two special cases bypass the bind table:
-//   • a digit key 1..9 → focus report N (the Nth live report of the pane node)
+// One special case bypasses the bind table:
 //   • a bind whose `run` is the sentinel `__graph__` → send-keys `/graph` into
 //     the pane (toggles the in-pi GRAPH modal); the menu emits this directly so
 //     the dispatcher only handles it defensively.
@@ -23,7 +22,7 @@ import { InputError } from '../core/io.js';
 import { readConfig } from '../core/config.js';
 import { sendKeysEnter } from '../core/runtime/tmux-chrome.js';
 import { nodeInPane } from './node.js';
-import { getNode, subscribersOf, subscriptionsOf, view, fullName, } from '../core/canvas/index.js';
+import { getNode, subscribersOf, view, fullName, } from '../core/canvas/index.js';
 const pexec = promisify(execFile);
 /** Template vars available to a `run` string. Single-valued vars interpolate
  *  in place (preserving spaces, e.g. a node name); `{subtree}` is multi-valued
@@ -76,7 +75,7 @@ export const chordLeaf = defineLeaf({
                 name: 'key',
                 type: 'string',
                 required: true,
-                constraint: 'The chord key pressed after alt+c (e.g. m, e, or a digit 1-9 for focus report N).',
+                constraint: 'The chord key pressed after alt+c (e.g. g or m).',
             },
         ],
         output: [
@@ -99,26 +98,6 @@ export const chordLeaf = defineLeaf({
                 next: 'Run from inside an agent\'s pane, or pass --pane <pane-id>.',
             });
         }
-        // Digit keys 1..9 → focus the Nth live report (generated, not a bind entry).
-        if (/^[1-9]$/.test(key)) {
-            const n = parseInt(key, 10);
-            const reports = subscriptionsOf(selfId)
-                .map((r) => r.node_id)
-                .filter((id) => {
-                const s = getNode(id)?.status;
-                return s === 'active' || s === 'idle';
-            });
-            const target = reports[n - 1];
-            if (target === undefined)
-                return { ran: false, key, node_id: selfId, action: 'noop' };
-            try {
-                await pexec('crtr', ['node', 'focus', target], { timeout: 15_000 });
-            }
-            catch {
-                /* best-effort */
-            }
-            return { ran: true, key, node_id: selfId, action: `node focus ${target}` };
-        }
         const bind = readConfig('user').canvasNav.prefixBinds[key];
         if (bind === undefined)
             return { ran: false, key, node_id: selfId, action: 'noop' };

package/dist/commands/revive.js

@@ -1,29 +1,43 @@
 // `crtr canvas revive` — explicit node revival.
 //
-// Bypasses the daemon: directly opens a fresh tmux window for a node that is
+// Bypasses the daemon: directly relaunches the broker engine for a node that is
 // done, idle, or dead. Default behavior resumes the saved pi conversation
 // (--session <id>); pass --fresh to start a clean pi session against the context dir.
+//
+// `--all` sweeps EVERY disconnected node (engine not running, resumable session)
+// in one shot — the recovery for a reboot / mass-crash / daemon-down-a-while
+// event. It is a two-step gate: run it once to PREVIEW the candidates (nothing is
+// launched), then confirm to actually revive them.
 import { defineLeaf } from '../core/command.js';
 import { InputError } from '../core/io.js';
 import { reviveNode } from '../core/runtime/revive.js';
+import { listDisconnected, reviveAll } from '../core/runtime/revive-all.js';
 import { waitForBrokerViewSocket } from '../core/runtime/placement.js';
-import { getNode } from '../core/canvas/index.js';
+import { getNode, fullName } from '../core/canvas/index.js';
 // ---------------------------------------------------------------------------
 // revive node
 // ---------------------------------------------------------------------------
 export const reviveLeaf = defineLeaf({
     name: 'revive',
-    description: 'reopen a window for a done/idle/dead/canceled node',
-    whenToUse: 'you want to bring a dormant node back yourself — reopen a window for one that is done, idle, dead, or canceled: resume a node you closed with `node close`, reopen a finished worker for a follow-up, or restart a crashed one now instead of waiting. It resumes the saved conversation by default, or can restart the node clean. You rarely need this for crashes — the daemon auto-revives those; reach for it to bring a node back on demand, or to revive a canceled node the daemon will never touch on its own',
+    description: 'reopen a window for a done/idle/dead/canceled node, or --all disconnected nodes',
+    whenToUse: 'you want to bring a dormant node back yourself — reopen a window for one that is done, idle, dead, or canceled: resume a node you closed with `node close`, reopen a finished worker for a follow-up, or restart a crashed one now instead of waiting. It resumes the saved conversation by default, or can restart the node clean. Pass `--all` instead of a node id to bring back EVERY disconnected node at once (engine not running but a saved session intact) — the recovery after a reboot, a killed login/tmux session, a mass crash, or the daemon being down a while. You rarely need this for crashes — the daemon auto-revives those; reach for it to bring a node back on demand, to revive a canceled node the daemon will never touch on its own, or to mass-reconnect survivors after a disconnect event',
     help: {
         name: 'canvas revive',
-        summary: 'open a fresh tmux window for a node, optionally resuming its saved pi conversation',
+        summary: 'relaunch a node\'s broker engine (resuming its saved conversation), or --all disconnected nodes',
         params: [
             {
                 kind: 'positional',
                 name: 'node',
-                required: true,
-                constraint: 'Node id to revive.',
+                required: false,
+                constraint: 'Node id to revive. Omit when using --all.',
+            },
+            {
+                kind: 'flag',
+                name: 'all',
+                type: 'bool',
+                required: false,
+                default: false,
+                constraint: 'Revive EVERY disconnected node (engine not running, resumable saved session) — excludes done/canceled (terminal-by-choice). Run it once to PREVIEW the candidates; nothing is launched until you confirm. Mutually exclusive with a node id.',
             },
             {
                 kind: 'flag',
@@ -31,24 +45,63 @@ export const reviveLeaf = defineLeaf({
                 type: 'bool',
                 required: false,
                 default: false,
-                constraint: 'When set, start a clean pi session (no --session). Default: resume the saved conversation.',
+                constraint: 'When set, start a clean pi session (no --session). Default: resume the saved conversation. Ignored with --all (which always resumes).',
+            },
+            // --force is a DELIBERATELY UNDOCUMENTED confirmation gate for --all (hidden
+            // from -h; see FlagParam.hidden). Silas's intent (2026-06-13): a mass revive
+            // can have large, unforeseen consequences, so the agent must NOT be able to
+            // discover a one-shot bypass by reading the schema. The unforced --all path
+            // PREVIEWS the candidates and instructs the agent to double-check with the
+            // USER before re-running; only then, having been told the flag, does it pass
+            // --force. Documenting it here would defeat that gate.
+            {
+                kind: 'flag',
+                name: 'force',
+                type: 'bool',
+                required: false,
+                default: false,
+                hidden: true,
+                constraint: 'Confirm a --all sweep (internal gate; see code comment).',
             },
         ],
         output: [
             { name: 'window', type: 'string', required: false, constraint: 'Always null — the revived broker is headless and opens no tmux window. Kept for caller back-compat.' },
             { name: 'session', type: 'string', required: false, constraint: 'The node\'s last live location session, or null — the headless broker has no tmux session of its own.' },
-            { name: 'resumed', type: 'boolean', required: true, constraint: 'True when pi was told to --session the saved conversation.' },
-            { name: 'ready', type: 'boolean', required: true, constraint: 'True when the revived broker\'s view.sock accepted a connection before return — the node is immediately attachable/drivable.' },
+            { name: 'resumed', type: 'boolean', required: false, constraint: 'True when pi was told to --session the saved conversation. Single-node revive only.' },
+            { name: 'ready', type: 'boolean', required: false, constraint: 'True when the revived broker\'s view.sock accepted a connection before return — the node is immediately attachable/drivable. Single-node revive only.' },
+            { name: 'mode', type: 'string', required: false, constraint: '"preview" (the --all candidate list, nothing launched), "revived" (the --all sweep ran), or absent for a single-node revive.' },
+            { name: 'candidates', type: 'string', required: false, constraint: '--all preview: the node ids that WOULD be revived (newline-joined). Empty when none are disconnected.' },
+            { name: 'revived', type: 'string', required: false, constraint: '--all sweep: the node ids whose broker engine was relaunched (newline-joined).' },
+            { name: 'failed', type: 'string', required: false, constraint: '--all sweep: node ids whose relaunch threw, with the error (newline-joined). Absent when none failed.' },
         ],
         outputKind: 'object',
         effects: [
             'Launches the node\'s detached headless broker engine (no tmux window).',
-            'Updates the node\'s canvas record: status=active, intent=null, window=<new>.',
+            'Updates the node\'s canvas record: status=active, intent=null.',
             'Blocks until the broker\'s view.sock accepts a connection (up to ~30s), so a caller can attach/dial immediately on return.',
+            '--all without confirmation launches NOTHING — it only previews the disconnected candidates.',
         ],
     },
     run: async (input) => {
+        const all = input['all'] ?? false;
         const nodeId = input['node'];
+        if (all) {
+            if (nodeId !== undefined) {
+                throw new InputError({
+                    error: 'conflicting_args',
+                    message: '`--all` reconnects every disconnected node; do not also pass a node id.',
+                    next: 'Run `crtr canvas revive --all` (no node id), or `crtr canvas revive <node>` for one.',
+                });
+            }
+            return runReviveAll(input);
+        }
+        if (nodeId === undefined) {
+            throw new InputError({
+                error: 'missing_parameter',
+                message: 'pass a node id to revive, or `--all` to reconnect every disconnected node.',
+                next: 'Run `crtr canvas revive <node>` or `crtr canvas revive --all`. List nodes with `crtr node inspect list`.',
+            });
+        }
         const fresh = input['fresh'] ?? false;
         // Validate the node exists before attempting revival.
         const meta = getNode(nodeId);
@@ -72,3 +125,61 @@ export const reviveLeaf = defineLeaf({
         };
     },
 });
+// ---------------------------------------------------------------------------
+// revive --all
+// ---------------------------------------------------------------------------
+/** One line per candidate: `<id>  <full name>  [<status>]`. */
+function describe(ids) {
+    return ids
+        .map((m) => {
+        const meta = getNode(m.node_id);
+        const name = meta !== null ? fullName(meta) : m.node_id;
+        const status = meta !== null ? meta.status : '?';
+        return `  ${m.node_id}  ${name}  [${status}]`;
+    })
+        .join('\n');
+}
+/** The --all sweep, gated on confirmation. Without `--force` it PREVIEWS the
+ *  disconnected candidates and returns WITHOUT launching anything, telling the
+ *  agent to double-check with the user first (a mass revive can have large,
+ *  unforeseen consequences). With `--force` it actually resumes them all. */
+function runReviveAll(input) {
+    const force = input['force'] ?? false;
+    const candidates = listDisconnected();
+    if (candidates.length === 0) {
+        return {
+            mode: 'preview',
+            candidates: '',
+            message: 'No disconnected nodes — every node with a resumable session already has a running engine. Nothing to revive.',
+        };
+    }
+    if (!force) {
+        const list = describe(candidates);
+        return {
+            mode: 'preview',
+            candidates: candidates.map((m) => m.node_id).join('\n'),
+            // Directive for the AGENT (not a documented flag): this is a preview, and a
+            // mass revive can have large, unforeseen consequences — so confirm with the
+            // USER before proceeding, then re-run to actually revive.
+            message: `${candidates.length} disconnected node(s) WOULD be revived (RESUME). Nothing has been launched yet:\n\n` +
+                `${list}\n\n` +
+                `Reviving all of these at once can have large, unforeseen consequences (a flood of resumed engines, ` +
+                `cost, side effects from each node continuing its work). This is a preview only — DOUBLE-CHECK WITH THE ` +
+                `USER that they want every node above brought back before you proceed. Once they confirm, re-run the ` +
+                `revive with confirmation to actually relaunch them.`,
+        };
+    }
+    const res = reviveAll();
+    const out = {
+        mode: 'revived',
+        revived: res.revived.join('\n'),
+        message: `Revived ${res.revived.length} disconnected node(s) (RESUME).`,
+    };
+    if (res.failed.length > 0) {
+        out['failed'] = res.failed.map((f) => `${f.node_id}: ${f.error}`).join('\n');
+        out['message'] =
+            `Revived ${res.revived.length} of ${res.revived.length + res.failed.length} disconnected node(s); ` +
+                `${res.failed.length} failed to relaunch (see failed).`;
+    }
+    return out;
+}

package/dist/core/__tests__/listing-completeness.test.js

@@ -9,8 +9,8 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { buildRoot } from '../../build-root.js';
-test('every non-hidden listing child declares description + whenToUse', () => {
-    const root = buildRoot();
+test('every non-hidden listing child declares description + whenToUse', async () => {
+    const root = await buildRoot();
     const missing = [];
     const walk = (branch, path) => {
         for (const child of branch.help.listing ?? []) {

package/dist/core/__tests__/revive-all.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/revive-all.test.js

@@ -0,0 +1,138 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/revive-all.test.ts
+//
+// REGRESSION LOCK — gh issue #9 (revive-all over the canvas). The heart of the
+// feature is the SELECTION predicate `isDisconnected`: which nodes a one-shot
+// "resume everything" sweep relaunches. Getting that wrong is the whole risk —
+// too narrow strands survivors, too broad resurrects finished/closed
+// conversations nobody asked to reopen, or double-spawns a live node.
+//
+// (1) WHY PURE, NOT TMUX — isDisconnected is a total function of (meta, isAlive
+//     probe, scope): zero process, zero tmux, instant. The liveness probe is
+//     injected so the alive/dead branch is exercised without a real pid. The
+//     reviveAll orchestration over it is a thin select-then-reviveNode loop;
+//     reviveNode is covered (double-spawn guard) by revive.test.ts.
+//
+// (2) THE INVARIANTS LOCKED:
+//     - engine running (live pid) → NOT disconnected (never double-spawn).
+//     - no resumable saved session (no pi_session_id AND no pi_session_file) →
+//       NOT disconnected (nothing to resume).
+//     - dead/crashed with a session → disconnected (swept by default).
+//     - done/canceled (terminal-by-choice) → always excluded (no opt-in).
+//     - kind:'human' (the human bridge, never a pi engine) → never disconnected.
+//
+// (3) HOW IT FAILS IF THE LOGIC REGRESSES — drop the terminal-by-choice guard
+//     and the done/canceled exclusion asserts go RED; drop the session
+//     requirement and the no-session assert goes RED; invert the liveness branch
+//     and the live-pid assert goes RED.
+import { test, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { isDisconnected, TERMINAL_BY_CHOICE, listDisconnected } from '../runtime/revive-all.js';
+import { createNode } from '../canvas/canvas.js';
+import { closeDb } from '../canvas/db.js';
+const ALIVE = () => true;
+const DEAD = () => false;
+function meta(over = {}) {
+    return {
+        node_id: 'n',
+        name: 'n',
+        created: new Date().toISOString(),
+        cwd: '/tmp/work',
+        kind: 'developer',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+        pi_pid: 1234,
+        pi_session_id: 'uuid-1',
+        pi_session_file: '/abs/sess.jsonl',
+        ...over,
+    };
+}
+// --- engine liveness branch -------------------------------------------------
+test('a node whose engine is RUNNING (live pid) is NOT disconnected — never double-spawn', () => {
+    assert.equal(isDisconnected(meta({ pi_pid: 1234 }), ALIVE), false);
+});
+test('a node whose engine is DEAD but has a saved session IS disconnected', () => {
+    assert.equal(isDisconnected(meta({ pi_pid: 1234 }), DEAD), true);
+});
+test('a node with a null pid (never/ no longer recorded) and a session IS disconnected', () => {
+    assert.equal(isDisconnected(meta({ pi_pid: null }), DEAD), true);
+});
+// --- resumable-session requirement -----------------------------------------
+test('a dead node with NO resumable saved session is NOT disconnected', () => {
+    assert.equal(isDisconnected(meta({ pi_session_id: null, pi_session_file: null }), DEAD), false);
+});
+test('a session FILE alone (older node, no id) is enough to be disconnected', () => {
+    assert.equal(isDisconnected(meta({ pi_session_id: null }), DEAD), true);
+});
+// --- terminal-by-choice scope ----------------------------------------------
+for (const status of TERMINAL_BY_CHOICE) {
+    test(`a dead-engine '${status}' node is EXCLUDED (terminal-by-choice, no opt-in)`, () => {
+        assert.equal(isDisconnected(meta({ status: status }), DEAD), false);
+    });
+}
+test("a crashed 'dead' node is swept by default (a crash is involuntary, not terminal-by-choice)", () => {
+    assert.equal(isDisconnected(meta({ status: 'dead' }), DEAD), true);
+});
+test("dormant 'idle' nodes with a saved session are swept by default", () => {
+    assert.equal(isDisconnected(meta({ status: 'idle', intent: 'idle-release' }), DEAD), true);
+});
+// --- human-bridge carve-out -------------------------------------------------
+test("kind:'human' rows (the human bridge, never a pi engine) are never disconnected", () => {
+    assert.equal(isDisconnected(meta({ kind: 'human', pi_pid: null }), DEAD), false);
+});
+// --- listDisconnected over a live canvas (the sweep's selection) -------------
+//
+// Locks that the canvas-wide select returns EXACTLY the disconnected set against
+// the REAL isPidAlive probe — a live-engine node (this process's pid) is kept
+// out, a crashed one with a session is in, a done one is excluded. No broker is
+// launched: listDisconnected is the side-effect-free preview the command gates on.
+let home;
+function deadPid() {
+    const r = spawnSync('true', [], { stdio: 'ignore' });
+    return r.pid ?? 0x7ffffffe;
+}
+function fabricate(id, over) {
+    createNode({
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd: '/tmp/work',
+        host_kind: 'broker',
+        kind: 'developer',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+        pi_session_id: 'uuid-' + id,
+        ...over,
+    });
+    closeDb();
+}
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-revive-all-'));
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+});
+test('listDisconnected returns EXACTLY the disconnected nodes (crashed-with-session), excluding live + done', () => {
+    // disconnected: dead pid + a saved session.
+    fabricate('crashed', { status: 'active', pi_pid: deadPid() });
+    // connected: a LIVE engine pid (this process — read-only here) → excluded.
+    fabricate('live', { status: 'active', pi_pid: process.pid });
+    // terminal-by-choice: done + dead pid + session → excluded.
+    fabricate('finished', { status: 'done', pi_pid: deadPid() });
+    // no resumable session → excluded.
+    fabricate('sessionless', { status: 'active', pi_pid: deadPid(), pi_session_id: null });
+    const ids = listDisconnected().map((m) => m.node_id).sort();
+    assert.deepEqual(ids, ['crashed'], 'only the crashed-with-session node is swept');
+});

package/dist/core/help.d.ts

@@ -29,6 +29,10 @@ export interface FlagParam {
     /** When true, the flag may appear multiple times; values accumulate into an
      *  array. TODO: no current leaf needs this — implement when first leaf migrates. */
     repeatable?: boolean;
+    /** When true, the flag is PARSED normally but never rendered in `-h`. For a
+     *  deliberately-undiscoverable confirmation gate the agent must be TOLD about
+     *  in the command's own output (not by reading the schema), never advertised. */
+    hidden?: boolean;
 }
 /** Raw stdin content blob (piped text, not parsed as JSON). */
 export interface StdinParam {

package/dist/core/help.js

@@ -213,7 +213,8 @@ export function renderLeafArgv(h) {
         lines.push(h.guide);
     }
     lines.push('');
-    const params = h.params ?? [];
+    // Hidden flags are parsed but never advertised in -h (see FlagParam.hidden).
+    const params = (h.params ?? []).filter((p) => !(p.kind === 'flag' && p.hidden === true));
     if (params.length > 0) {
         lines.push('Input');
         const labels = params.map(paramLabel);

package/dist/core/runtime/placement.d.ts

@@ -23,11 +23,11 @@ export declare function listFocuses(): FocusRow[];
  *  targeting it. */
 export declare function graphSurfaceTarget(nodeId: string): FocusRow | null;
 /** Synchronously wait until a broker's view.sock accepts a connection. The spawn
- *  and focus flows are sync (the command layer calls them directly), so the
- *  readiness probe lives in a short child Node process that can use async net
- *  events while this process blocks in `spawnSync`. Success proves more than file
- *  existence: it is robust to a stale leftover socket the launching broker has
- *  not unlinked yet, because only an accepting listener exits 0. */
+ *  and focus flows are sync (the command layer calls them directly), so the async
+ *  net poll runs in a worker THREAD while this thread blocks on `Atomics.wait` —
+ *  in-process, no child Node cold-start. Success proves more than file existence:
+ *  it is robust to a stale leftover socket the launching broker has not unlinked
+ *  yet, because only an accepting listener yields a `connect`. */
 export declare function waitForBrokerViewSocket(nodeId: string): boolean;
 /** A reviver: ensure a node's broker ENGINE is alive (idempotent → reviveNode →
  *  headlessBrokerHost.launch). Injected so placement.ts need not import revive.ts

package/dist/core/runtime/placement.js

@@ -23,7 +23,7 @@
 //     model-over-driver so the §5.1 import-lint ("only placement.ts /
 //     tmux-chrome.ts import tmux.ts") holds — every other module reaches the
 //     driver verbs through here.
-import { spawnSync } from 'node:child_process';
+import { Worker } from 'node:worker_threads';
 import { join } from 'node:path';
 import { getNode, openFocusRow, closeFocusRow, getFocusByNode, getFocusByPane, getFocusById, listFocuses as listFocusRows, view, } from '../canvas/index.js';
 import { paneExists, paneLocation, ensureSession, openNodeWindow, splitWindow, closePane, currentTmux, switchClient, selectWindow, getPaneOption, } from './tmux.js';
@@ -115,19 +115,17 @@ export function graphSurfaceTarget(nodeId) {
 // ---------------------------------------------------------------------------
 const BROKER_FOCUS_SOCKET_WAIT_MS = 30_000;
 const BROKER_FOCUS_SOCKET_RETRY_MS = 100;
-/** Synchronously wait until a broker's view.sock accepts a connection. The spawn
- *  and focus flows are sync (the command layer calls them directly), so the
- *  readiness probe lives in a short child Node process that can use async net
- *  events while this process blocks in `spawnSync`. Success proves more than file
- *  existence: it is robust to a stale leftover socket the launching broker has
- *  not unlinked yet, because only an accepting listener exits 0. */
-export function waitForBrokerViewSocket(nodeId) {
-    const sockPath = join(nodeDir(nodeId), 'view.sock');
-    const probe = `
+// The probe runs inside a worker thread (see waitForBrokerViewSocket). Async net
+// events drive the same poll loop; the worker reports its verdict into a shared
+// Int32 (0 = pending, 1 = accepted, 2 = gave up) and Atomics.notify wakes the
+// blocked main thread. eval:true ⇒ CommonJS, so `require` and workerData apply.
+const VIEW_SOCKET_PROBE_WORKER = `
 const net = require('node:net');
-const sockPath = process.argv[1];
-const deadline = Date.now() + Number(process.argv[2]);
-const delay = Number(process.argv[3]);
+const { workerData, parentPort } = require('node:worker_threads');
+const { buffer, sockPath, waitMs, retryMs } = workerData;
+const result = new Int32Array(buffer);
+const deadline = Date.now() + waitMs;
+const report = (code) => { Atomics.store(result, 0, code); Atomics.notify(result, 0); };
 function attempt() {
   let socket;
   let settled = false;
@@ -135,9 +133,9 @@ function attempt() {
     if (settled) return;
     settled = true;
     if (socket !== undefined) socket.destroy();
-    if (ok) process.exit(0);
-    if (Date.now() >= deadline) process.exit(1);
-    setTimeout(attempt, delay);
+    if (ok) { report(1); return; }
+    if (Date.now() >= deadline) { report(2); return; }
+    setTimeout(attempt, retryMs);
   };
   try {
     socket = net.createConnection(sockPath);
@@ -147,18 +145,31 @@ function attempt() {
   }
   socket.once('connect', () => finish(true));
   socket.once('error', () => finish(false));
-  socket.setTimeout(delay, () => finish(false));
+  socket.setTimeout(retryMs, () => finish(false));
 }
 attempt();
+void parentPort;
 `;
-    const r = spawnSync(process.execPath, ['--input-type=commonjs', '-e', probe, sockPath, String(BROKER_FOCUS_SOCKET_WAIT_MS), String(BROKER_FOCUS_SOCKET_RETRY_MS)], {
-        stdio: 'ignore',
-        timeout: BROKER_FOCUS_SOCKET_WAIT_MS + 1_000,
-        // Keep the probe deterministic: NODE_OPTIONS like --input-type=module or
-        // --inspect-brk can break/hang a tiny `node -e` readiness check.
-        env: { ...process.env, NODE_OPTIONS: '' },
+/** Synchronously wait until a broker's view.sock accepts a connection. The spawn
+ *  and focus flows are sync (the command layer calls them directly), so the async
+ *  net poll runs in a worker THREAD while this thread blocks on `Atomics.wait` —
+ *  in-process, no child Node cold-start. Success proves more than file existence:
+ *  it is robust to a stale leftover socket the launching broker has not unlinked
+ *  yet, because only an accepting listener yields a `connect`. */
+export function waitForBrokerViewSocket(nodeId) {
+    const sockPath = join(nodeDir(nodeId), 'view.sock');
+    const buffer = new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT);
+    const result = new Int32Array(buffer);
+    const worker = new Worker(VIEW_SOCKET_PROBE_WORKER, {
+        eval: true,
+        workerData: { buffer, sockPath, waitMs: BROKER_FOCUS_SOCKET_WAIT_MS, retryMs: BROKER_FOCUS_SOCKET_RETRY_MS },
     });
-    return r.status === 0;
+    worker.unref();
+    // Block until the worker reports (or a hard timeout matching the old
+    // spawnSync). 'not-equal' covers the worker finishing before we wait.
+    Atomics.wait(result, 0, 0, BROKER_FOCUS_SOCKET_WAIT_MS + 1_000);
+    void worker.terminate();
+    return Atomics.load(result, 0) === 1;
 }
 function newFocusId() {
     return `f-${newNodeId()}`;

package/dist/core/runtime/revive-all.d.ts

@@ -0,0 +1,42 @@
+import type { NodeMeta, NodeStatus } from '../canvas/types.js';
+/** Statuses a node lands in DELIBERATELY: a worker that finished its own work
+ *  (`done`) or a node a human closed/reaped (`canceled`). The daemon never
+ *  auto-revives these (see reapDeadResidue in crtrd.ts), and revive-all leaves
+ *  them alone too — resurrecting finished and closed conversations en masse would
+ *  flood the canvas with work nobody asked to reopen. `dead` is NOT here: a crash
+ *  is involuntary, so it is swept. (Silas, 2026-06-13: no opt-in to include these
+ *  — the exclusion is unconditional.) */
+export declare const TERMINAL_BY_CHOICE: readonly NodeStatus[];
+/** True when `meta`'s engine is NOT running but it has a resumable saved session
+ *  — the precise "disconnected" predicate (gh #9).
+ *
+ *  - engine not running: no live `pi_pid` (a dead/absent broker pid).
+ *  - resumable: a captured pi session (`pi_session_file` or `pi_session_id`) —
+ *    without one there is nothing to resume.
+ *  - `human`-kind rows are the `crtr human` bridge, never a pi engine, so they
+ *    are never "disconnected" (mirrors the daemon's superviseTick carve-out).
+ *  - terminal-by-choice (`done`/`canceled`) is always excluded.
+ *
+ *  Pure: the liveness probe is injected so scope is unit-testable without real
+ *  processes. */
+export declare function isDisconnected(meta: NodeMeta, isAlive: (pid: number | null | undefined) => boolean): boolean;
+/** Every disconnected node on the canvas — the set a revive-all WOULD relaunch.
+ *  This is the PREVIEW: it has no side effects, so the command can list the
+ *  candidates and gate on confirmation before any engine is launched. */
+export declare function listDisconnected(): NodeMeta[];
+export interface ReviveAllResult {
+    /** Node ids whose broker engine reviveAll relaunched (RESUME). */
+    revived: string[];
+    /** Per-node failures — reviveNode threw (its launch failed). One bad node
+     *  never aborts the sweep. */
+    failed: {
+        node_id: string;
+        error: string;
+    }[];
+}
+/** RESUME every disconnected node. reviveNode is the ONLY sanctioned launcher
+ *  and self-guards the double-spawn (a node whose broker pid is already live is a
+ *  no-op), so this is a thin orchestrator over `listDisconnected`: revive each
+ *  with resume:true. One failing node never aborts the sweep — its error is
+ *  collected and the rest proceed. */
+export declare function reviveAll(): ReviveAllResult;

package/dist/core/runtime/revive-all.js

@@ -0,0 +1,78 @@
+// revive-all — resume EVERY disconnected node in one shot (gh issue #9).
+//
+// After a mass-disconnect event (a reboot, a killed login/tmux session, a mass
+// crash, or the daemon being down a while) many nodes end up with their
+// canvas.db row + saved conversation intact but NO broker engine running. The
+// daemon recovers some on its own (active|idle rows with a dead pid grace-revive
+// on its next tick), but it deliberately never touches terminal/dormant states,
+// so the operator is left reviving survivors one id at a time.
+//
+// This module is the single sweep: `listDisconnected` selects every DISCONNECTED
+// node (engine not running, but a resumable saved session exists), and
+// `reviveAll` RESUMEs each via reviveNode — the only sanctioned launcher, which
+// self-guards the double-spawn. The selection predicate (`isDisconnected`) is
+// pure so the scope rules are unit-testable without booting a single process.
+import { listNodes, getNode } from '../canvas/index.js';
+import { isPidAlive } from '../canvas/pid.js';
+import { reviveNode } from './revive.js';
+/** Statuses a node lands in DELIBERATELY: a worker that finished its own work
+ *  (`done`) or a node a human closed/reaped (`canceled`). The daemon never
+ *  auto-revives these (see reapDeadResidue in crtrd.ts), and revive-all leaves
+ *  them alone too — resurrecting finished and closed conversations en masse would
+ *  flood the canvas with work nobody asked to reopen. `dead` is NOT here: a crash
+ *  is involuntary, so it is swept. (Silas, 2026-06-13: no opt-in to include these
+ *  — the exclusion is unconditional.) */
+export const TERMINAL_BY_CHOICE = ['done', 'canceled'];
+/** True when `meta`'s engine is NOT running but it has a resumable saved session
+ *  — the precise "disconnected" predicate (gh #9).
+ *
+ *  - engine not running: no live `pi_pid` (a dead/absent broker pid).
+ *  - resumable: a captured pi session (`pi_session_file` or `pi_session_id`) —
+ *    without one there is nothing to resume.
+ *  - `human`-kind rows are the `crtr human` bridge, never a pi engine, so they
+ *    are never "disconnected" (mirrors the daemon's superviseTick carve-out).
+ *  - terminal-by-choice (`done`/`canceled`) is always excluded.
+ *
+ *  Pure: the liveness probe is injected so scope is unit-testable without real
+ *  processes. */
+export function isDisconnected(meta, isAlive) {
+    if (meta.kind === 'human')
+        return false;
+    if (isAlive(meta.pi_pid))
+        return false; // engine running → connected
+    if (meta.pi_session_id == null && meta.pi_session_file == null)
+        return false; // nothing to resume
+    if (TERMINAL_BY_CHOICE.includes(meta.status))
+        return false;
+    return true;
+}
+/** Every disconnected node on the canvas — the set a revive-all WOULD relaunch.
+ *  This is the PREVIEW: it has no side effects, so the command can list the
+ *  candidates and gate on confirmation before any engine is launched. */
+export function listDisconnected() {
+    const out = [];
+    for (const row of listNodes()) {
+        const meta = getNode(row.node_id);
+        if (meta !== null && isDisconnected(meta, isPidAlive))
+            out.push(meta);
+    }
+    return out;
+}
+/** RESUME every disconnected node. reviveNode is the ONLY sanctioned launcher
+ *  and self-guards the double-spawn (a node whose broker pid is already live is a
+ *  no-op), so this is a thin orchestrator over `listDisconnected`: revive each
+ *  with resume:true. One failing node never aborts the sweep — its error is
+ *  collected and the rest proceed. */
+export function reviveAll() {
+    const result = { revived: [], failed: [] };
+    for (const meta of listDisconnected()) {
+        try {
+            reviveNode(meta.node_id, { resume: true });
+            result.revived.push(meta.node_id);
+        }
+        catch (err) {
+            result.failed.push({ node_id: meta.node_id, error: err.message });
+        }
+    }
+    return result;
+}

package/dist/core/runtime/tmux.d.ts

@@ -178,8 +178,8 @@ export declare function switchClient(session: string): boolean;
  *  empty, same limitation as the menu's `/promote` item. Best-effort. */
 export declare function sendKeysEnter(pane: string, text: string): boolean;
 /** Bind Alt+C to the crouter action menu. Best-effort; false if tmux fails.
- *  The built-in items (promote/demote/detach/close/browse) are static; the canvas-nav
- *  chords (graph/manager/expand/report-N + any custom prefixBind) are appended
+ *  The built-in items (promote/resume/demote/detach/close) are static; the canvas-nav
+ *  chords (default g→graph, m→manager + any custom prefixBind) are appended
  *  from `canvasNav.prefixBinds`, each routed through `crtr canvas chord` (or, for
  *  the `__graph__` sentinel, a `send-keys '/graph'`) so the menu stays static
  *  while behaviour is config-driven. */

package/dist/core/runtime/tmux.js

@@ -336,8 +336,8 @@ export function sendKeysEnter(pane, text) {
  *  `prefixBind` may not claim these (the built-in item wins). */
 const RESERVED_MENU_KEYS = new Set(['o', 'r', 'd', 'D', 'x']);
 /** Bind Alt+C to the crouter action menu. Best-effort; false if tmux fails.
- *  The built-in items (promote/demote/detach/close/browse) are static; the canvas-nav
- *  chords (graph/manager/expand/report-N + any custom prefixBind) are appended
+ *  The built-in items (promote/resume/demote/detach/close) are static; the canvas-nav
+ *  chords (default g→graph, m→manager + any custom prefixBind) are appended
  *  from `canvasNav.prefixBinds`, each routed through `crtr canvas chord` (or, for
  *  the `__graph__` sentinel, a `send-keys '/graph'`) so the menu stays static
  *  while behaviour is config-driven. */
@@ -363,7 +363,7 @@ export function installMenuBinding() {
         // marks them canceled); revivable. Output discarded — the keypress just acts.
         { name: 'close agent + subtree', key: 'x', cmd: `run-shell "crtr node close --pane '#{pane_id}' >/dev/null 2>&1"` },
     ];
-    // Canvas-nav chords from config (default: g→graph, m→manager, e→expand). The
+    // Canvas-nav chords from config (default: g→graph, m→manager). The
     // `__graph__` sentinel toggles the in-pi GRAPH modal via send-keys; every
     // other bind shells the chord dispatcher, which resolves the pane's node and
     // interpolates the bind at popup time. Keys colliding with the built-ins are
@@ -382,26 +382,16 @@ export function installMenuBinding() {
             : `run-shell "crtr canvas chord --pane '#{pane_id}' --key ${key} >/dev/null 2>&1"`;
         items.push({ name, key, cmd });
     }
-    // Focus report N: nine generated chord items (1..9), each resolved by the
-    // dispatcher to subscriptionsOf(self)[N-1] at popup time.
-    for (let n = 1; n <= 9; n++) {
-        items.push({
-            name: `focus report ${n}`,
-            key: `${n}`,
-            cmd: `run-shell "crtr canvas chord --pane '#{pane_id}' --key ${n} >/dev/null 2>&1"`,
-        });
-    }
-    // Alt+C TOGGLE: re-pressing Alt+C while the menu is open should DISMISS it.
-    // display-menu is modal, so the root `M-c` binding is shadowed while the menu
-    // is up; tmux instead assembles the re-pressed Esc+c into the meta key `M-c`
-    // and delivers it to the menu's own key handler. An unhandled key is ignored
-    // (the menu just stays open) and the trailing `c` never leaks to the editor
-    // (verified empirically in tmux 3.6b: no native ESC-cancel + c-leak occurs for
-    // an atomic keypress). We catch that `M-c` with a menu item keyed to it whose
-    // command is empty — selecting it runs nothing and closes the menu. The row
-    // doubles as the menu's self-documenting dismiss hint. Placed last so it reads
-    // as chrome below the actions; `M-c` collides with no mnemonic above.
-    items.push({ name: 'close menu', key: 'M-c', cmd: '' });
+    // Dismiss hint. A tmux display-menu always closes on its native cancel keys
+    // (Escape / q / C-c), encoding-independent. We do NOT try to catch a re-pressed
+    // Alt+C: under `extended-keys on` (common, and what pi negotiates) the second
+    // Alt+C reaches the overlay as a CSI-u key (`\033[99;3u`) that tmux's menu does
+    // NOT match against an `M-c` mnemonic item, so a "close menu" row keyed M-c
+    // never fires and the menu just sits open (verified in tmux 3.6b: legacy Esc+c
+    // closes, CSI-u does not). Instead, a disabled (`-` prefix → dim, unselectable)
+    // last row tells the user the close keys that always work. Placed last so it
+    // reads as chrome below the actions.
+    items.push({ name: '-esc / q to close', key: '', cmd: '' });
     // tmux's -x sets the menu's LEFT edge. To sit the box INSIDE the pane's
     // top-right corner, shift x left by the box width (longest line + tmux chrome:
     // borders + padding + the right-aligned mnemonic-key column) via format math.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crouton-kit/crouter",
-  "version": "0.3.29",
+  "version": "0.3.31",
   "description": "crtr — fast access to skills, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",