@crouton-kit/crouter 0.3.30 → 0.3.31

package/dist/clients/attach/__tests__/editor-newline.test.js

@@ -1,15 +1,19 @@
-// Regression: in the attach viewer, Alt+Enter did NOTHING — not a newline, not a
-// submit. The editor was SWALLOWING it. Root cause: pi-coding-agent's
+// Regression (#11): in the attach viewer, Alt+Enter did NOTHING on an INSTALLED
+// (non-deduped) crtr — not a newline, not a submit. Root cause: pi-coding-agent's
 // CustomEditor resolves `@earendil-works/pi-tui` from its OWN node_modules, a
-// SEPARATE module instance from the one `config-load` imports (a non-deduped
-// install). config-load registered the KeybindingsManager only on its copy, but
-// the editor's super reads `getKeybindings()` from ITS instance — stuck at the
-// default `tui.input.newLine = shift+enter`. So the attach `alt+enter → newLine`
-// binding was invisible to the editor: Alt+Enter (`\x1b[13;3u`) matched neither
-// newLine nor submit and fell through. `mirrorKeybindingsToEditor` registers the
-// SAME manager on the editor's pi-tui instance; this test feeds the exact
-// Alt+Enter / Enter byte sequences a terminal sends and asserts the behavior.
-// See mirrorKeybindingsToEditor in src/clients/attach/config-load.ts.
+// SEPARATE module instance from the one `config-load` imports. The base Editor
+// reads `getKeybindings()` from THAT instance — stuck at the default
+// `tui.input.newLine = shift+enter` unless the `mirrorKeybindingsToEditor` shim
+// (best-effort, `import.meta.resolve`-based) succeeds in registering crtr's
+// manager on it. On install layouts where that mirror silently fails, the
+// `alt+enter → newLine` override never reached the editor and Alt+Enter
+// (`\x1b[13;3u`) matched neither newLine nor submit and fell through.
+//
+// The fix makes the chord self-contained: `TitledEditor.handleInput` matches
+// newLine against crtr's OWN KeybindingsManager (the one CustomEditor already
+// uses for `app.*`) and inserts the newline directly, so it no longer depends on
+// the cross-instance mirror. The third test below builds the editor WITHOUT the
+// mirror and is the real guard for the installed-layout failure.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { mkdtempSync } from 'node:fs';
@@ -26,7 +30,7 @@ async function buildEditor() {
     // attach DEFAULT (`ATTACH_KEYBINDING_OVERRIDES` adds alt+enter to newLine).
     const agentDir = mkdtempSync(join(tmpdir(), 'crtr-kb-'));
     const km = createKeybindingsManager(agentDir);
-    await mirrorKeybindingsToEditor(km); // the fix
+    await mirrorKeybindingsToEditor(km); // mirror still runs for general tui.* parity
     const tui = new TUI(new ProcessTerminal());
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     return new TitledEditor(tui, { borderColor: (s) => s, selectList: {} }, km, {
@@ -55,3 +59,24 @@ test('attach editor still submits on plain Enter', async () => {
     assert.equal(submitted, 'hello', 'plain Enter must submit');
     assert.equal(editor.getText(), '', 'editor clears after submit');
 });
+test('attach editor inserts a newline on Alt+Enter even WITHOUT the cross-instance mirror (#11)', async () => {
+    // Reproduces the installed-layout failure: the editor's pi-tui instance never
+    // received crtr's alt+enter override (mirror not run). TitledEditor.handleInput
+    // must still newline by matching crtr's own km directly.
+    const agentDir = mkdtempSync(join(tmpdir(), 'crtr-kb-'));
+    const km = createKeybindingsManager(agentDir);
+    // NOTE: deliberately NOT calling mirrorKeybindingsToEditor.
+    const tui = new TUI(new ProcessTerminal());
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const editor = new TitledEditor(tui, { borderColor: (s) => s, selectList: {} }, km, {
+        paddingX: 1,
+    });
+    let submitted = null;
+    editor.onSubmit = (t) => {
+        submitted = t;
+    };
+    editor.setText('hello');
+    editor.handleInput(ALT_ENTER);
+    assert.equal(editor.getText(), 'hello\n', 'Alt+Enter must newline without relying on the mirror');
+    assert.equal(submitted, null, 'Alt+Enter must not submit');
+});

package/dist/clients/attach/attach-cmd.js

@@ -31,7 +31,7 @@ import { writeClipboardText } from './clipboard-text.js';
 import { buildCanvasPanelLines } from './canvas-panels.js';
 import { GraphOverlay } from './graph-overlay.js';
 import { slashCommandList } from './slash-commands.js';
-import { applyTheme, attachPalette, createKeybindingsManager, defaultAgentDir, mirrorKeybindingsToEditor, mirrorKittyProtocolToEditor, } from './config-load.js';
+import { applyTheme, attachPalette, createKeybindingsManager, defaultAgentDir, mirrorKeybindingsToEditor, mirrorKittyProtocolToEditor, resolveFdPath, } from './config-load.js';
 import { buildLoginPicker, buildLogoutPicker } from './auth-pickers.js';
 import { TitledEditor, thinkingBorderColor, thinkingTitleStyle, defaultTitleStyle } from './titled-editor.js';
 import { fetchGitInfo } from './git-info.js';
@@ -134,6 +134,11 @@ async function runAttach(nodeId, observer) {
     // deduped install. Awaited before tui.start so the editor never handles a key
     // against stale defaults.
     await mirrorKeybindingsToEditor(km);
+    // Resolve `fd` once so the editor's @-mention picker can list files. pi-tui's
+    // CombinedAutocompleteProvider yields zero file suggestions without it (issue
+    // #6); `null` on a host with no fd (and no download) just leaves @-mention
+    // file-less, matching pi's own degraded behavior.
+    const fdPath = await resolveFdPath();
     // The front door installs the Alt+C menu binding before it ever loads a theme,
     // so it lands unstyled. Now that this viewer process HAS themed (applyTheme
     // above populated the live-theme global), re-install it so the menu picks up
@@ -170,7 +175,7 @@ async function runAttach(nodeId, observer) {
     // Slash-command autocomplete: builtins + native canvas commands now; enriched
     // with the broker's engine/extension/skill commands on the get_commands ack.
     const setCommands = (commands) => {
-        editor.setAutocompleteProvider(new CombinedAutocompleteProvider(slashCommandList(commands), meta.cwd));
+        editor.setAutocompleteProvider(new CombinedAutocompleteProvider(slashCommandList(commands), meta.cwd, fdPath));
     };
     setCommands();
     // 3. Render layer (T5). ChatView owns the chat scroll + activity spinner; the
@@ -182,6 +187,9 @@ async function runAttach(nodeId, observer) {
     let role = observer ? 'observer' : 'controller';
     let brokerAgentDir;
     let liveState;
+    // Shell/bash mode: the editor text leads with `!`. Tracks pi's interactive
+    // `isBashMode`, which recolors the editor border green as a visual cue (#7).
+    let bashMode = false;
     let notice = '';
     // Live context occupancy for the footer: `contextTokens` is the prompt-token
     // count of the most recent assistant turn (input + cacheRead + cacheWrite =
@@ -365,16 +373,38 @@ async function runAttach(nodeId, observer) {
     // routing (T6) reads `state.isStreaming`, so this must stay current — the
     // broker only ships full state in `welcome`, so we patch isStreaming/name/etc
     // from the relayed event stream below.
+    // Paint the editor border + title chip. Shell/bash mode (leading `!`) wins and
+    // forces the whole frame green (#7); otherwise the hue tracks the thinking
+    // level. One place so the onChange bash toggle and live-state updates agree.
+    const paintEditorFrame = () => {
+        if (bashMode) {
+            editor.borderColor = pal.bashMode;
+            editor.titleStyle = (s) => `\x1b[42m\x1b[97m\x1b[1m ${s} \x1b[0m`;
+        }
+        else {
+            editor.borderColor = thinkingBorderColor(liveState?.thinkingLevel, pal.border);
+            // Title chip background = the same thinking-level color (bold white text),
+            // so the name chip and the border rule read as one hue.
+            editor.titleStyle = thinkingTitleStyle(liveState?.thinkingLevel, defaultTitleStyle);
+        }
+    };
+    // Recolor the editor when `!` enters/leaves the front of the input (#7). pi's
+    // interactive mode does the same off `editor.onChange`.
+    editor.onChange = (text) => {
+        const next = text.trimStart().startsWith('!');
+        if (next === bashMode)
+            return;
+        bashMode = next;
+        paintEditorFrame();
+        tui.requestRender();
+    };
     const setLiveState = (state) => {
         liveState = state;
         input.setState(state);
         // The session name lives in the editor's top border (solid chip); the border
         // color tracks the agent's thinking level. Both follow live state.
         editor.title = state.sessionName ? `⬢ ${state.sessionName}` : '';
-        editor.borderColor = thinkingBorderColor(state.thinkingLevel, pal.border);
-        // Title chip background = the same thinking-level color (bold white text), so
-        // the name chip and the border rule read as one hue.
-        editor.titleStyle = thinkingTitleStyle(state.thinkingLevel, defaultTitleStyle);
+        paintEditorFrame();
         renderFooter();
         // Panel liveness rides the relayed event stream (agent_start/agent_end/
         // queue_update/session_info_changed all patch state through here) plus the

package/dist/clients/attach/config-load.d.ts

@@ -16,6 +16,7 @@ export declare function mirrorKeybindingsToEditor(km: KeybindingsManager): Promi
  *  instance (ProcessTerminal sets it only on OUR copy). Call after the terminal
  *  has negotiated, i.e. after `tui.start()`. */
 export declare function mirrorKittyProtocolToEditor(active: boolean): Promise<void>;
+export declare function resolveFdPath(): Promise<string | null>;
 /**
  * The user's theme name from pi settings — project (`<cwd>/.pi/settings.json`)
  * overrides global (`~/.pi/agent/settings.json`). `undefined` → pi's default.
@@ -62,6 +63,11 @@ export interface AttachPalette {
     error: (s: string) => string;
     /** Warning / transient notices. Same constraint as `error` → ANSI yellow. */
     warning: (s: string) => string;
+    /** Editor border when the input is in shell/bash mode (leading `!`). pi paints
+     *  this from its `bashMode` theme color (default `green`), which pi does NOT
+     *  re-export through its public surface — so, like `error`/`warning`, this is
+     *  the semantically-correct ANSI green, not an ad-hoc hardcode. */
+    bashMode: (s: string) => string;
 }
 /**
  * Build the attach chrome's color palette from the LIVE theme. Call AFTER

package/dist/clients/attach/config-load.js

@@ -144,6 +144,37 @@ export async function mirrorKeybindingsToEditor(km) {
 export async function mirrorKittyProtocolToEditor(active) {
     (await editorPiTui())?.setKittyProtocolActive(active);
 }
+/**
+ * Resolve the `fd` binary path the @-mention file picker needs. pi-tui's
+ * `CombinedAutocompleteProvider` only returns file suggestions when handed an
+ * `fdPath` (its third ctor arg) — without it, typing `@` triggers the picker but
+ * `getFuzzyFileSuggestions` returns `[]`, so the picker never appears (issue #6).
+ * pi's own interactive mode resolves this via `ensureTool('fd')` from its
+ * internal `utils/tools-manager` (checks pi's managed bin dir + system PATH,
+ * downloading the binary if missing). That module is NOT on pi-coding-agent's
+ * `.`-only export map, so we reach it the same way we reach the editor's pi-tui
+ * instance: resolve the package entry, then import the sibling file by URL
+ * (file URLs bypass the bare-specifier exports gate). Best-effort: any
+ * resolution/import failure (or no fd available) → `null`, and the picker stays
+ * file-less rather than crashing.
+ */
+let fdPathPromise;
+export function resolveFdPath() {
+    if (!fdPathPromise) {
+        fdPathPromise = (async () => {
+            try {
+                const pcaEntry = import.meta.resolve('@earendil-works/pi-coding-agent');
+                const toolsManagerUrl = new URL('./utils/tools-manager.js', pcaEntry).href;
+                const toolsManager = (await import(toolsManagerUrl));
+                return (await toolsManager.ensureTool('fd', true)) ?? null;
+            }
+            catch {
+                return null;
+            }
+        })();
+    }
+    return fdPathPromise;
+}
 /**
  * The user's theme name from pi settings — project (`<cwd>/.pi/settings.json`)
  * overrides global (`~/.pi/agent/settings.json`). `undefined` → pi's default.
@@ -174,6 +205,7 @@ export function applyTheme(opts) {
 const FAINT = (s) => `\x1b[2m${s}\x1b[22m`;
 const RED = (s) => `\x1b[31m${s}\x1b[39m`;
 const YELLOW = (s) => `\x1b[33m${s}\x1b[39m`;
+const GREEN = (s) => `\x1b[32m${s}\x1b[39m`;
 /**
  * Build the attach chrome's color palette from the LIVE theme. Call AFTER
  * `applyTheme()` — the colors are pulled from pi's `getMarkdownTheme()` /
@@ -204,6 +236,7 @@ export function attachPalette() {
         bold: md.bold,
         error: RED,
         warning: YELLOW,
+        bashMode: GREEN,
         surface: (line) => `${bgOn}${line.replace(/\x1b\[0m/g, `\x1b[0m${bgOn}`)}\x1b[49m`,
     };
 }

package/dist/clients/attach/titled-editor.d.ts

@@ -1,4 +1,5 @@
 import { CustomEditor } from '@earendil-works/pi-coding-agent';
+import { type EditorOptions, type EditorTheme, type TUI } from '@earendil-works/pi-tui';
 /** Thinking levels pi cycles through (shift+tab), lowest → highest budget. */
 export type ThinkingLevel = 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
 /** The default (thinking `off`) title chip: reverse video + a space of padding
@@ -20,6 +21,23 @@ export declare function thinkingTitleStyle(level: string | undefined, fallback:
  *  regression test. */
 export declare function composeTopBorder(width: number, title: string, info: string, titleStyle: (s: string) => string, borderColor: (s: string) => string): string;
 export declare class TitledEditor extends CustomEditor {
+    /** crtr's OWN keybindings manager — the same one CustomEditor matches `app.*`
+     *  against. We keep a reference so `handleInput` can resolve the newline chord
+     *  here, independent of the editor's (possibly separate) pi-tui module global. */
+    private readonly km;
+    constructor(tui: TUI, theme: EditorTheme, keybindings: ConstructorParameters<typeof CustomEditor>[2], options?: EditorOptions);
+    /** Insert a newline on the newLine chord (Alt+Enter / Shift+Enter) using crtr's
+     *  OWN keybindings manager, then defer everything else to the stock editor.
+     *
+     *  The base `Editor` resolves newLine against `getKeybindings()` on ITS pi-tui
+     *  instance, which in a non-deduped install is a DIFFERENT module than the one
+     *  carrying crtr's `alt+enter` override — so the override can silently never
+     *  reach it and Alt+Enter falls through to submit (issue #11). crtr's `km` (the
+     *  same manager CustomEditor matches `app.*` against) always carries the
+     *  override, so matching the chord here makes the newline behavior independent
+     *  of cross-instance keybinding mirroring. Skipped while the autocomplete popup
+     *  is open so Enter-to-confirm keeps working. */
+    handleInput(data: string): void;
     /** Session-name chip painted into the LEFT of the top border. Empty → plain. */
     title: string;
     /** Pre-styled context string painted into the RIGHT of the top border (cwd /

package/dist/clients/attach/titled-editor.js

@@ -6,21 +6,23 @@
 //      on each state update), mirroring pi's `getThinkingBorderColor`.
 // Both are pure render-layer chrome; nothing here touches the socket or session.
 import { CustomEditor } from '@earendil-works/pi-coding-agent';
-import { truncateToWidth, visibleWidth } from '@earendil-works/pi-tui';
-/** Per-level border/chip color as a 24-bit RGB triple — ONE blue-violet hue at
- *  CONSTANT perceived lightness (luma ≈ 120) whose SATURATION alone climbs with
- *  the budget: a near-gray blue at `minimal` deepening to a vivid violet at
- *  `xhigh`, never getting lighter or darker — only more colorful. (pi paints its
- *  own `thinking*` theme colors off its public palette surface, so we own this
- *  ramp directly — truecolor, not the 16-color ANSI hues, so the saturation
- *  climb actually reads.) `off` falls back to the caller's default border color. */
+import { truncateToWidth, visibleWidth, } from '@earendil-works/pi-tui';
+/** Per-level border/chip color as a 24-bit RGB triple. Each level ROTATES HUE by
+ *  a large step (~35–45°) along a "heat" ramp — indigo → violet → magenta → pink
+ *  → red-orange — so adjacent levels are unmistakably different at a glance (a
+ *  constant-hue saturation climb read as nearly identical; see #8). All sit at
+ *  roughly constant, high-ish lightness so each is vivid on a dark terminal, and
+ *  the cool→hot direction maps intuitively onto a climbing thinking budget. (pi
+ *  paints its own `thinking*` theme colors off its public palette surface, so we
+ *  own this ramp directly — truecolor, not the 16-color ANSI hues, so the hue
+ *  sweep actually reads.) `off` falls back to the caller's default border color. */
 const THINKING_RGB = {
     off: undefined, // default border color
-    minimal: [125, 115, 135], // near-gray blue-violet
-    low: [129, 109, 151], // muted blue-violet
-    medium: [134, 103, 168], // violet
-    high: [139, 98, 184], // deeper violet
-    xhigh: [144, 92, 200], // vivid violet
+    minimal: [96, 132, 220], // indigo / cornflower blue
+    low: [150, 110, 214], // violet
+    medium: [200, 98, 196], // magenta
+    high: [224, 102, 142], // pink-red
+    xhigh: [228, 120, 84], // red-orange
 };
 /** The default (thinking `off`) title chip: reverse video + a space of padding
  *  each side, so the name reads as a label sitting on the border rule. Used as
@@ -63,6 +65,35 @@ export function composeTopBorder(width, title, info, titleStyle, borderColor) {
     return chip + borderColor('─'.repeat(fill)) + infoChip;
 }
 export class TitledEditor extends CustomEditor {
+    /** crtr's OWN keybindings manager — the same one CustomEditor matches `app.*`
+     *  against. We keep a reference so `handleInput` can resolve the newline chord
+     *  here, independent of the editor's (possibly separate) pi-tui module global. */
+    km;
+    // CustomEditor's ctor signature; captured so we own the newline chord (see
+    // handleInput). The keybindings param is typed as pi's app-subclass manager,
+    // but the attach viewer feeds it pi-tui's base manager — hence the cast.
+    constructor(tui, theme, keybindings, options) {
+        super(tui, theme, keybindings, options);
+        this.km = keybindings;
+    }
+    /** Insert a newline on the newLine chord (Alt+Enter / Shift+Enter) using crtr's
+     *  OWN keybindings manager, then defer everything else to the stock editor.
+     *
+     *  The base `Editor` resolves newLine against `getKeybindings()` on ITS pi-tui
+     *  instance, which in a non-deduped install is a DIFFERENT module than the one
+     *  carrying crtr's `alt+enter` override — so the override can silently never
+     *  reach it and Alt+Enter falls through to submit (issue #11). crtr's `km` (the
+     *  same manager CustomEditor matches `app.*` against) always carries the
+     *  override, so matching the chord here makes the newline behavior independent
+     *  of cross-instance keybinding mirroring. Skipped while the autocomplete popup
+     *  is open so Enter-to-confirm keeps working. */
+    handleInput(data) {
+        if (!this.isShowingAutocomplete() && this.km.matches(data, 'tui.input.newLine')) {
+            this.insertTextAtCursor('\n');
+            return;
+        }
+        super.handleInput(data);
+    }
     /** Session-name chip painted into the LEFT of the top border. Empty → plain. */
     title = '';
     /** Pre-styled context string painted into the RIGHT of the top border (cwd /

package/dist/commands/revive.js

@@ -1,29 +1,43 @@
 // `crtr canvas revive` — explicit node revival.
 //
-// Bypasses the daemon: directly opens a fresh tmux window for a node that is
+// Bypasses the daemon: directly relaunches the broker engine for a node that is
 // done, idle, or dead. Default behavior resumes the saved pi conversation
 // (--session <id>); pass --fresh to start a clean pi session against the context dir.
+//
+// `--all` sweeps EVERY disconnected node (engine not running, resumable session)
+// in one shot — the recovery for a reboot / mass-crash / daemon-down-a-while
+// event. It is a two-step gate: run it once to PREVIEW the candidates (nothing is
+// launched), then confirm to actually revive them.
 import { defineLeaf } from '../core/command.js';
 import { InputError } from '../core/io.js';
 import { reviveNode } from '../core/runtime/revive.js';
+import { listDisconnected, reviveAll } from '../core/runtime/revive-all.js';
 import { waitForBrokerViewSocket } from '../core/runtime/placement.js';
-import { getNode } from '../core/canvas/index.js';
+import { getNode, fullName } from '../core/canvas/index.js';
 // ---------------------------------------------------------------------------
 // revive node
 // ---------------------------------------------------------------------------
 export const reviveLeaf = defineLeaf({
     name: 'revive',
-    description: 'reopen a window for a done/idle/dead/canceled node',
-    whenToUse: 'you want to bring a dormant node back yourself — reopen a window for one that is done, idle, dead, or canceled: resume a node you closed with `node close`, reopen a finished worker for a follow-up, or restart a crashed one now instead of waiting. It resumes the saved conversation by default, or can restart the node clean. You rarely need this for crashes — the daemon auto-revives those; reach for it to bring a node back on demand, or to revive a canceled node the daemon will never touch on its own',
+    description: 'reopen a window for a done/idle/dead/canceled node, or --all disconnected nodes',
+    whenToUse: 'you want to bring a dormant node back yourself — reopen a window for one that is done, idle, dead, or canceled: resume a node you closed with `node close`, reopen a finished worker for a follow-up, or restart a crashed one now instead of waiting. It resumes the saved conversation by default, or can restart the node clean. Pass `--all` instead of a node id to bring back EVERY disconnected node at once (engine not running but a saved session intact) — the recovery after a reboot, a killed login/tmux session, a mass crash, or the daemon being down a while. You rarely need this for crashes — the daemon auto-revives those; reach for it to bring a node back on demand, to revive a canceled node the daemon will never touch on its own, or to mass-reconnect survivors after a disconnect event',
     help: {
         name: 'canvas revive',
-        summary: 'open a fresh tmux window for a node, optionally resuming its saved pi conversation',
+        summary: 'relaunch a node\'s broker engine (resuming its saved conversation), or --all disconnected nodes',
         params: [
             {
                 kind: 'positional',
                 name: 'node',
-                required: true,
-                constraint: 'Node id to revive.',
+                required: false,
+                constraint: 'Node id to revive. Omit when using --all.',
+            },
+            {
+                kind: 'flag',
+                name: 'all',
+                type: 'bool',
+                required: false,
+                default: false,
+                constraint: 'Revive EVERY disconnected node (engine not running, resumable saved session) — excludes done/canceled (terminal-by-choice). Run it once to PREVIEW the candidates; nothing is launched until you confirm. Mutually exclusive with a node id.',
             },
             {
                 kind: 'flag',
@@ -31,24 +45,63 @@ export const reviveLeaf = defineLeaf({
                 type: 'bool',
                 required: false,
                 default: false,
-                constraint: 'When set, start a clean pi session (no --session). Default: resume the saved conversation.',
+                constraint: 'When set, start a clean pi session (no --session). Default: resume the saved conversation. Ignored with --all (which always resumes).',
+            },
+            // --force is a DELIBERATELY UNDOCUMENTED confirmation gate for --all (hidden
+            // from -h; see FlagParam.hidden). Silas's intent (2026-06-13): a mass revive
+            // can have large, unforeseen consequences, so the agent must NOT be able to
+            // discover a one-shot bypass by reading the schema. The unforced --all path
+            // PREVIEWS the candidates and instructs the agent to double-check with the
+            // USER before re-running; only then, having been told the flag, does it pass
+            // --force. Documenting it here would defeat that gate.
+            {
+                kind: 'flag',
+                name: 'force',
+                type: 'bool',
+                required: false,
+                default: false,
+                hidden: true,
+                constraint: 'Confirm a --all sweep (internal gate; see code comment).',
             },
         ],
         output: [
             { name: 'window', type: 'string', required: false, constraint: 'Always null — the revived broker is headless and opens no tmux window. Kept for caller back-compat.' },
             { name: 'session', type: 'string', required: false, constraint: 'The node\'s last live location session, or null — the headless broker has no tmux session of its own.' },
-            { name: 'resumed', type: 'boolean', required: true, constraint: 'True when pi was told to --session the saved conversation.' },
-            { name: 'ready', type: 'boolean', required: true, constraint: 'True when the revived broker\'s view.sock accepted a connection before return — the node is immediately attachable/drivable.' },
+            { name: 'resumed', type: 'boolean', required: false, constraint: 'True when pi was told to --session the saved conversation. Single-node revive only.' },
+            { name: 'ready', type: 'boolean', required: false, constraint: 'True when the revived broker\'s view.sock accepted a connection before return — the node is immediately attachable/drivable. Single-node revive only.' },
+            { name: 'mode', type: 'string', required: false, constraint: '"preview" (the --all candidate list, nothing launched), "revived" (the --all sweep ran), or absent for a single-node revive.' },
+            { name: 'candidates', type: 'string', required: false, constraint: '--all preview: the node ids that WOULD be revived (newline-joined). Empty when none are disconnected.' },
+            { name: 'revived', type: 'string', required: false, constraint: '--all sweep: the node ids whose broker engine was relaunched (newline-joined).' },
+            { name: 'failed', type: 'string', required: false, constraint: '--all sweep: node ids whose relaunch threw, with the error (newline-joined). Absent when none failed.' },
         ],
         outputKind: 'object',
         effects: [
             'Launches the node\'s detached headless broker engine (no tmux window).',
-            'Updates the node\'s canvas record: status=active, intent=null, window=<new>.',
+            'Updates the node\'s canvas record: status=active, intent=null.',
             'Blocks until the broker\'s view.sock accepts a connection (up to ~30s), so a caller can attach/dial immediately on return.',
+            '--all without confirmation launches NOTHING — it only previews the disconnected candidates.',
         ],
     },
     run: async (input) => {
+        const all = input['all'] ?? false;
         const nodeId = input['node'];
+        if (all) {
+            if (nodeId !== undefined) {
+                throw new InputError({
+                    error: 'conflicting_args',
+                    message: '`--all` reconnects every disconnected node; do not also pass a node id.',
+                    next: 'Run `crtr canvas revive --all` (no node id), or `crtr canvas revive <node>` for one.',
+                });
+            }
+            return runReviveAll(input);
+        }
+        if (nodeId === undefined) {
+            throw new InputError({
+                error: 'missing_parameter',
+                message: 'pass a node id to revive, or `--all` to reconnect every disconnected node.',
+                next: 'Run `crtr canvas revive <node>` or `crtr canvas revive --all`. List nodes with `crtr node inspect list`.',
+            });
+        }
         const fresh = input['fresh'] ?? false;
         // Validate the node exists before attempting revival.
         const meta = getNode(nodeId);
@@ -72,3 +125,61 @@ export const reviveLeaf = defineLeaf({
         };
     },
 });
+// ---------------------------------------------------------------------------
+// revive --all
+// ---------------------------------------------------------------------------
+/** One line per candidate: `<id>  <full name>  [<status>]`. */
+function describe(ids) {
+    return ids
+        .map((m) => {
+        const meta = getNode(m.node_id);
+        const name = meta !== null ? fullName(meta) : m.node_id;
+        const status = meta !== null ? meta.status : '?';
+        return `  ${m.node_id}  ${name}  [${status}]`;
+    })
+        .join('\n');
+}
+/** The --all sweep, gated on confirmation. Without `--force` it PREVIEWS the
+ *  disconnected candidates and returns WITHOUT launching anything, telling the
+ *  agent to double-check with the user first (a mass revive can have large,
+ *  unforeseen consequences). With `--force` it actually resumes them all. */
+function runReviveAll(input) {
+    const force = input['force'] ?? false;
+    const candidates = listDisconnected();
+    if (candidates.length === 0) {
+        return {
+            mode: 'preview',
+            candidates: '',
+            message: 'No disconnected nodes — every node with a resumable session already has a running engine. Nothing to revive.',
+        };
+    }
+    if (!force) {
+        const list = describe(candidates);
+        return {
+            mode: 'preview',
+            candidates: candidates.map((m) => m.node_id).join('\n'),
+            // Directive for the AGENT (not a documented flag): this is a preview, and a
+            // mass revive can have large, unforeseen consequences — so confirm with the
+            // USER before proceeding, then re-run to actually revive.
+            message: `${candidates.length} disconnected node(s) WOULD be revived (RESUME). Nothing has been launched yet:\n\n` +
+                `${list}\n\n` +
+                `Reviving all of these at once can have large, unforeseen consequences (a flood of resumed engines, ` +
+                `cost, side effects from each node continuing its work). This is a preview only — DOUBLE-CHECK WITH THE ` +
+                `USER that they want every node above brought back before you proceed. Once they confirm, re-run the ` +
+                `revive with confirmation to actually relaunch them.`,
+        };
+    }
+    const res = reviveAll();
+    const out = {
+        mode: 'revived',
+        revived: res.revived.join('\n'),
+        message: `Revived ${res.revived.length} disconnected node(s) (RESUME).`,
+    };
+    if (res.failed.length > 0) {
+        out['failed'] = res.failed.map((f) => `${f.node_id}: ${f.error}`).join('\n');
+        out['message'] =
+            `Revived ${res.revived.length} of ${res.revived.length + res.failed.length} disconnected node(s); ` +
+                `${res.failed.length} failed to relaunch (see failed).`;
+    }
+    return out;
+}

package/dist/core/__tests__/revive-all.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/revive-all.test.js

@@ -0,0 +1,138 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/revive-all.test.ts
+//
+// REGRESSION LOCK — gh issue #9 (revive-all over the canvas). The heart of the
+// feature is the SELECTION predicate `isDisconnected`: which nodes a one-shot
+// "resume everything" sweep relaunches. Getting that wrong is the whole risk —
+// too narrow strands survivors, too broad resurrects finished/closed
+// conversations nobody asked to reopen, or double-spawns a live node.
+//
+// (1) WHY PURE, NOT TMUX — isDisconnected is a total function of (meta, isAlive
+//     probe, scope): zero process, zero tmux, instant. The liveness probe is
+//     injected so the alive/dead branch is exercised without a real pid. The
+//     reviveAll orchestration over it is a thin select-then-reviveNode loop;
+//     reviveNode is covered (double-spawn guard) by revive.test.ts.
+//
+// (2) THE INVARIANTS LOCKED:
+//     - engine running (live pid) → NOT disconnected (never double-spawn).
+//     - no resumable saved session (no pi_session_id AND no pi_session_file) →
+//       NOT disconnected (nothing to resume).
+//     - dead/crashed with a session → disconnected (swept by default).
+//     - done/canceled (terminal-by-choice) → always excluded (no opt-in).
+//     - kind:'human' (the human bridge, never a pi engine) → never disconnected.
+//
+// (3) HOW IT FAILS IF THE LOGIC REGRESSES — drop the terminal-by-choice guard
+//     and the done/canceled exclusion asserts go RED; drop the session
+//     requirement and the no-session assert goes RED; invert the liveness branch
+//     and the live-pid assert goes RED.
+import { test, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { isDisconnected, TERMINAL_BY_CHOICE, listDisconnected } from '../runtime/revive-all.js';
+import { createNode } from '../canvas/canvas.js';
+import { closeDb } from '../canvas/db.js';
+const ALIVE = () => true;
+const DEAD = () => false;
+function meta(over = {}) {
+    return {
+        node_id: 'n',
+        name: 'n',
+        created: new Date().toISOString(),
+        cwd: '/tmp/work',
+        kind: 'developer',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+        pi_pid: 1234,
+        pi_session_id: 'uuid-1',
+        pi_session_file: '/abs/sess.jsonl',
+        ...over,
+    };
+}
+// --- engine liveness branch -------------------------------------------------
+test('a node whose engine is RUNNING (live pid) is NOT disconnected — never double-spawn', () => {
+    assert.equal(isDisconnected(meta({ pi_pid: 1234 }), ALIVE), false);
+});
+test('a node whose engine is DEAD but has a saved session IS disconnected', () => {
+    assert.equal(isDisconnected(meta({ pi_pid: 1234 }), DEAD), true);
+});
+test('a node with a null pid (never/ no longer recorded) and a session IS disconnected', () => {
+    assert.equal(isDisconnected(meta({ pi_pid: null }), DEAD), true);
+});
+// --- resumable-session requirement -----------------------------------------
+test('a dead node with NO resumable saved session is NOT disconnected', () => {
+    assert.equal(isDisconnected(meta({ pi_session_id: null, pi_session_file: null }), DEAD), false);
+});
+test('a session FILE alone (older node, no id) is enough to be disconnected', () => {
+    assert.equal(isDisconnected(meta({ pi_session_id: null }), DEAD), true);
+});
+// --- terminal-by-choice scope ----------------------------------------------
+for (const status of TERMINAL_BY_CHOICE) {
+    test(`a dead-engine '${status}' node is EXCLUDED (terminal-by-choice, no opt-in)`, () => {
+        assert.equal(isDisconnected(meta({ status: status }), DEAD), false);
+    });
+}
+test("a crashed 'dead' node is swept by default (a crash is involuntary, not terminal-by-choice)", () => {
+    assert.equal(isDisconnected(meta({ status: 'dead' }), DEAD), true);
+});
+test("dormant 'idle' nodes with a saved session are swept by default", () => {
+    assert.equal(isDisconnected(meta({ status: 'idle', intent: 'idle-release' }), DEAD), true);
+});
+// --- human-bridge carve-out -------------------------------------------------
+test("kind:'human' rows (the human bridge, never a pi engine) are never disconnected", () => {
+    assert.equal(isDisconnected(meta({ kind: 'human', pi_pid: null }), DEAD), false);
+});
+// --- listDisconnected over a live canvas (the sweep's selection) -------------
+//
+// Locks that the canvas-wide select returns EXACTLY the disconnected set against
+// the REAL isPidAlive probe — a live-engine node (this process's pid) is kept
+// out, a crashed one with a session is in, a done one is excluded. No broker is
+// launched: listDisconnected is the side-effect-free preview the command gates on.
+let home;
+function deadPid() {
+    const r = spawnSync('true', [], { stdio: 'ignore' });
+    return r.pid ?? 0x7ffffffe;
+}
+function fabricate(id, over) {
+    createNode({
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd: '/tmp/work',
+        host_kind: 'broker',
+        kind: 'developer',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+        pi_session_id: 'uuid-' + id,
+        ...over,
+    });
+    closeDb();
+}
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-revive-all-'));
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+});
+test('listDisconnected returns EXACTLY the disconnected nodes (crashed-with-session), excluding live + done', () => {
+    // disconnected: dead pid + a saved session.
+    fabricate('crashed', { status: 'active', pi_pid: deadPid() });
+    // connected: a LIVE engine pid (this process — read-only here) → excluded.
+    fabricate('live', { status: 'active', pi_pid: process.pid });
+    // terminal-by-choice: done + dead pid + session → excluded.
+    fabricate('finished', { status: 'done', pi_pid: deadPid() });
+    // no resumable session → excluded.
+    fabricate('sessionless', { status: 'active', pi_pid: deadPid(), pi_session_id: null });
+    const ids = listDisconnected().map((m) => m.node_id).sort();
+    assert.deepEqual(ids, ['crashed'], 'only the crashed-with-session node is swept');
+});

package/dist/core/help.d.ts

@@ -29,6 +29,10 @@ export interface FlagParam {
     /** When true, the flag may appear multiple times; values accumulate into an
      *  array. TODO: no current leaf needs this — implement when first leaf migrates. */
     repeatable?: boolean;
+    /** When true, the flag is PARSED normally but never rendered in `-h`. For a
+     *  deliberately-undiscoverable confirmation gate the agent must be TOLD about
+     *  in the command's own output (not by reading the schema), never advertised. */
+    hidden?: boolean;
 }
 /** Raw stdin content blob (piped text, not parsed as JSON). */
 export interface StdinParam {

package/dist/core/help.js

@@ -213,7 +213,8 @@ export function renderLeafArgv(h) {
         lines.push(h.guide);
     }
     lines.push('');
-    const params = h.params ?? [];
+    // Hidden flags are parsed but never advertised in -h (see FlagParam.hidden).
+    const params = (h.params ?? []).filter((p) => !(p.kind === 'flag' && p.hidden === true));
     if (params.length > 0) {
         lines.push('Input');
         const labels = params.map(paramLabel);

package/dist/core/runtime/revive-all.d.ts

@@ -0,0 +1,42 @@
+import type { NodeMeta, NodeStatus } from '../canvas/types.js';
+/** Statuses a node lands in DELIBERATELY: a worker that finished its own work
+ *  (`done`) or a node a human closed/reaped (`canceled`). The daemon never
+ *  auto-revives these (see reapDeadResidue in crtrd.ts), and revive-all leaves
+ *  them alone too — resurrecting finished and closed conversations en masse would
+ *  flood the canvas with work nobody asked to reopen. `dead` is NOT here: a crash
+ *  is involuntary, so it is swept. (Silas, 2026-06-13: no opt-in to include these
+ *  — the exclusion is unconditional.) */
+export declare const TERMINAL_BY_CHOICE: readonly NodeStatus[];
+/** True when `meta`'s engine is NOT running but it has a resumable saved session
+ *  — the precise "disconnected" predicate (gh #9).
+ *
+ *  - engine not running: no live `pi_pid` (a dead/absent broker pid).
+ *  - resumable: a captured pi session (`pi_session_file` or `pi_session_id`) —
+ *    without one there is nothing to resume.
+ *  - `human`-kind rows are the `crtr human` bridge, never a pi engine, so they
+ *    are never "disconnected" (mirrors the daemon's superviseTick carve-out).
+ *  - terminal-by-choice (`done`/`canceled`) is always excluded.
+ *
+ *  Pure: the liveness probe is injected so scope is unit-testable without real
+ *  processes. */
+export declare function isDisconnected(meta: NodeMeta, isAlive: (pid: number | null | undefined) => boolean): boolean;
+/** Every disconnected node on the canvas — the set a revive-all WOULD relaunch.
+ *  This is the PREVIEW: it has no side effects, so the command can list the
+ *  candidates and gate on confirmation before any engine is launched. */
+export declare function listDisconnected(): NodeMeta[];
+export interface ReviveAllResult {
+    /** Node ids whose broker engine reviveAll relaunched (RESUME). */
+    revived: string[];
+    /** Per-node failures — reviveNode threw (its launch failed). One bad node
+     *  never aborts the sweep. */
+    failed: {
+        node_id: string;
+        error: string;
+    }[];
+}
+/** RESUME every disconnected node. reviveNode is the ONLY sanctioned launcher
+ *  and self-guards the double-spawn (a node whose broker pid is already live is a
+ *  no-op), so this is a thin orchestrator over `listDisconnected`: revive each
+ *  with resume:true. One failing node never aborts the sweep — its error is
+ *  collected and the rest proceed. */
+export declare function reviveAll(): ReviveAllResult;

package/dist/core/runtime/revive-all.js

@@ -0,0 +1,78 @@
+// revive-all — resume EVERY disconnected node in one shot (gh issue #9).
+//
+// After a mass-disconnect event (a reboot, a killed login/tmux session, a mass
+// crash, or the daemon being down a while) many nodes end up with their
+// canvas.db row + saved conversation intact but NO broker engine running. The
+// daemon recovers some on its own (active|idle rows with a dead pid grace-revive
+// on its next tick), but it deliberately never touches terminal/dormant states,
+// so the operator is left reviving survivors one id at a time.
+//
+// This module is the single sweep: `listDisconnected` selects every DISCONNECTED
+// node (engine not running, but a resumable saved session exists), and
+// `reviveAll` RESUMEs each via reviveNode — the only sanctioned launcher, which
+// self-guards the double-spawn. The selection predicate (`isDisconnected`) is
+// pure so the scope rules are unit-testable without booting a single process.
+import { listNodes, getNode } from '../canvas/index.js';
+import { isPidAlive } from '../canvas/pid.js';
+import { reviveNode } from './revive.js';
+/** Statuses a node lands in DELIBERATELY: a worker that finished its own work
+ *  (`done`) or a node a human closed/reaped (`canceled`). The daemon never
+ *  auto-revives these (see reapDeadResidue in crtrd.ts), and revive-all leaves
+ *  them alone too — resurrecting finished and closed conversations en masse would
+ *  flood the canvas with work nobody asked to reopen. `dead` is NOT here: a crash
+ *  is involuntary, so it is swept. (Silas, 2026-06-13: no opt-in to include these
+ *  — the exclusion is unconditional.) */
+export const TERMINAL_BY_CHOICE = ['done', 'canceled'];
+/** True when `meta`'s engine is NOT running but it has a resumable saved session
+ *  — the precise "disconnected" predicate (gh #9).
+ *
+ *  - engine not running: no live `pi_pid` (a dead/absent broker pid).
+ *  - resumable: a captured pi session (`pi_session_file` or `pi_session_id`) —
+ *    without one there is nothing to resume.
+ *  - `human`-kind rows are the `crtr human` bridge, never a pi engine, so they
+ *    are never "disconnected" (mirrors the daemon's superviseTick carve-out).
+ *  - terminal-by-choice (`done`/`canceled`) is always excluded.
+ *
+ *  Pure: the liveness probe is injected so scope is unit-testable without real
+ *  processes. */
+export function isDisconnected(meta, isAlive) {
+    if (meta.kind === 'human')
+        return false;
+    if (isAlive(meta.pi_pid))
+        return false; // engine running → connected
+    if (meta.pi_session_id == null && meta.pi_session_file == null)
+        return false; // nothing to resume
+    if (TERMINAL_BY_CHOICE.includes(meta.status))
+        return false;
+    return true;
+}
+/** Every disconnected node on the canvas — the set a revive-all WOULD relaunch.
+ *  This is the PREVIEW: it has no side effects, so the command can list the
+ *  candidates and gate on confirmation before any engine is launched. */
+export function listDisconnected() {
+    const out = [];
+    for (const row of listNodes()) {
+        const meta = getNode(row.node_id);
+        if (meta !== null && isDisconnected(meta, isPidAlive))
+            out.push(meta);
+    }
+    return out;
+}
+/** RESUME every disconnected node. reviveNode is the ONLY sanctioned launcher
+ *  and self-guards the double-spawn (a node whose broker pid is already live is a
+ *  no-op), so this is a thin orchestrator over `listDisconnected`: revive each
+ *  with resume:true. One failing node never aborts the sweep — its error is
+ *  collected and the rest proceed. */
+export function reviveAll() {
+    const result = { revived: [], failed: [] };
+    for (const meta of listDisconnected()) {
+        try {
+            reviveNode(meta.node_id, { resume: true });
+            result.revived.push(meta.node_id);
+        }
+        catch (err) {
+            result.failed.push({ node_id: meta.node_id, error: err.message });
+        }
+    }
+    return result;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crouton-kit/crouter",
-  "version": "0.3.30",
+  "version": "0.3.31",
   "description": "crtr — fast access to skills, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",