@crouton-kit/crouter 0.3.32 → 0.3.33

package/dist/core/runtime/kickoff.js

@@ -8,7 +8,7 @@
 // Layout (the framing a revived node sees):
 //   <roadmap file=…>…</roadmap>            its evolving plan — the source of truth
 //   <context-dir path=…>…</context-dir>    what artifacts exist on disk
-//   <feed>Awaiting N nodes … digest</feed> who it waits on + unread reports
+//   <feed>Awaiting N nodes … digest</feed> live wait state + unread/catch-up feed
 //   <yield-message>…</yield-message>       the note its prior self left on yield
 //
 // The roadmap (NOT the original spawn prompt) carries the goal on a refresh: its
@@ -19,7 +19,6 @@
 // yield-message is one-shot (consumed on the next revive).
 import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, readdirSync, } from 'node:fs';
 import { join } from 'node:path';
-import { homedir } from 'node:os';
 import { contextDir, reportsDir, getNode, subscriptionsOf, subscribersOf, } from '../canvas/index.js';
 import { readRoadmap, roadmapPath } from './roadmap.js';
 import { buildWakeBearings } from './bearings.js';
@@ -132,56 +131,41 @@ export function drainBearings(meta) {
 // conversation is gone AND the monotonic inbox cursor has already advanced past
 // everything drained pre-yield, so the revived node loses sight of reports its
 // subscriptions pushed BEFORE the yield. The bodies are never lost — they persist
-// at reports/<ts>-<kind>.md forever — but nothing pointed the revived node at
-// them. reportHistoryLines renders those existing on-disk paths so it can catch
-// up; PATHS ONLY (the node dereferences what it needs), no body read, no parse.
-const REPORT_HISTORY_PER_SOURCE = 5;
-const REPORT_HISTORY_TOTAL_CAP = 20;
-/** Collapse the home-dir prefix of an absolute path to a leading `~`, so report
- *  paths render as `~/.crouter/canvas/nodes/<id>/reports/<ts>.md` instead of
- *  repeating the long absolute home prefix on every catch-up line — cheaper
- *  context, still dereferenceable by the revived node. A path NOT under the home
- *  dir (e.g. a CRTR_HOME / project-scope home elsewhere) is returned unchanged,
- *  so we never mangle a non-home path. */
-function tildify(p) {
-    const home = homedir();
-    return p.startsWith(home) ? '~' + p.slice(home.length) : p;
+// at reports/<ts>-<kind>.md forever — but a fresh revive needs a bounded index
+// that says history exists and how to expand it, not every path preloaded.
+const REPORT_HISTORY_SOURCE_CAP = 8;
+function reportKind(filename) {
+    return filename.match(/^[0-9]{8}T[0-9]{6}-(.+)\.md$/)?.[1] ?? 'report';
 }
-/** Recent report file PATHS (most-recent-first), grouped by publisher, for each
- *  ACTIVE subscription of `nodeId` — independent of publisher liveness, so a
- *  finished worker's history still surfaces for catch-up. Skips subscriptions
- *  whose reports dir is empty/missing. Returns [] when the node has no active
- *  subscriptions or none have reports yet (caller renders nothing extra). */
-function reportHistoryLines(nodeId) {
-    const lines = [];
-    let total = 0;
+/** Condensed report-history index for each ACTIVE subscription of `nodeId` —
+ *  independent of publisher liveness, so a finished worker's history still
+ *  surfaces for catch-up. Each source carries only its count and newest report
+ *  ref; older refs stay one command away via `canvas history show`. */
+function reportHistorySources(nodeId) {
+    const out = [];
     for (const sub of subscriptionsOf(nodeId).filter((s) => s.active)) {
-        if (total >= REPORT_HISTORY_TOTAL_CAP)
-            break;
         const dir = reportsDir(sub.node_id);
         if (!existsSync(dir))
             continue;
         const files = readdirSync(dir)
             .filter((f) => f.endsWith('.md'))
             .sort() // YYYYMMDDTHHmmss-<kind>.md — lexical sort = chronological
-            .reverse() // most recent first
-            .slice(0, REPORT_HISTORY_PER_SOURCE);
+            .reverse(); // most recent first
         if (files.length === 0)
             continue;
         const pub = getNode(sub.node_id);
-        lines.push(`  ${pub !== null ? `${pub.name} (${sub.node_id})` : sub.node_id}:`);
-        for (const f of files) {
-            if (total >= REPORT_HISTORY_TOTAL_CAP)
-                break;
-            lines.push(`    ${tildify(join(dir, f))}`);
-            total++;
-        }
+        out.push({
+            nodeId: sub.node_id,
+            name: pub?.name ?? sub.node_id,
+            count: files.length,
+            latest: files[0],
+        });
     }
-    return lines;
+    return out.sort((a, b) => b.latest.localeCompare(a.latest));
 }
 /** Render the <feed> block PURELY: the live "awaiting" roster (a read), the
- *  already-drained unread digest (from drainBearings), and the on-disk report
- *  history of this node's subscriptions (catch-up pointers). No cursor write. */
+ *  already-drained unread digest (from drainBearings), and a progressive index
+ *  to on-disk report history. No cursor write. */
 function feedBlock(nodeId, unreadDigest) {
     // Awaiting = active subscriptions whose publisher is still live (active|idle).
     const awaiting = subscriptionsOf(nodeId)
@@ -210,14 +194,16 @@ function feedBlock(nodeId, unreadDigest) {
     }
     // Catch-up history. The unread digest above only covers what arrived since the
     // cursor; on a refresh-revive the cursor has already passed everything drained
-    // pre-yield, so point the node at the durable report history that persists on
-    // disk. Renders nothing when the node has no active subscriptions with reports.
-    const history = reportHistoryLines(nodeId);
+    // pre-yield, so preserve the breadcrumb without preloading every old report.
+    const history = reportHistorySources(nodeId);
     if (history.length > 0) {
-        lines.push('', 'Report history on disk — the nodes you subscribe to keep every push they made; ' +
-            'these persist across your context refresh (the unread digest above only covers ' +
-            'what arrived since your cursor). Most recent first; dereference any you need. ' +
-            '`crtr feed read --all` replays the full inbox history, cursor-independent.', ...history);
+        const visible = history.slice(0, REPORT_HISTORY_SOURCE_CAP);
+        const hidden = history.length - visible.length;
+        const total = history.reduce((sum, h) => sum + h.count, 0);
+        lines.push('', `Report history on disk (collapsed): ${total} report${total === 1 ? '' : 's'} across ${history.length} subscribed node${history.length === 1 ? '' : 's'}. This is a catch-up index for reports your cursor already passed; read only what matters.`, ...visible.map((h) => {
+            const ref = `${h.nodeId}:reports/${h.latest}`;
+            return `  - ${h.name} (${h.nodeId}): ${h.count} report${h.count === 1 ? '' : 's'}; latest ${reportKind(h.latest)}: ${ref}`;
+        }), ...(hidden > 0 ? [`  - … ${hidden} more subscribed node${hidden === 1 ? '' : 's'} with reports hidden`] : []), 'Expand: `crtr canvas history read <ref>` for one listed report; `crtr canvas history show <node-id> --type report` for that node\'s full report list; `crtr feed read --all` for cursor-independent inbox history.');
     }
     return `<feed>\n${lines.join('\n')}\n</feed>`;
 }

package/dist/core/runtime/launch.d.ts

@@ -1,4 +1,5 @@
 import type { NodeMeta, LaunchSpec, Mode, Lifecycle } from '../canvas/index.js';
+import type { ModelProvider, ModelStrength } from '../../types.js';
 export declare const CANVAS_STOPHOOK_PATH: string;
 export declare const CANVAS_INBOX_WATCHER_PATH: string;
 export declare const CANVAS_NAV_PATH: string;
@@ -7,32 +8,46 @@ export declare const CANVAS_GOAL_CAPTURE_PATH: string;
 export declare const CANVAS_PASSIVE_CONTEXT_PATH: string;
 export declare const CANVAS_CONTEXT_INTRO_PATH: string;
 export declare const CANVAS_DOC_SUBSTRATE_PATH: string;
-export declare const CANVAS_COMMANDS_PATH: string;
-export declare const CANVAS_RESUME_PATH: string;
-export declare const CANVAS_VIEW_PATH: string;
 /** The canvas extensions every node loads, in order: stophook (routing +
  *  telemetry + session-id capture), inbox-watcher (wake), nav (in-editor
  *  graph chrome), recap (the per-node inactivity recap card — Haiku over the
  *  conversation, shown above the manager line after 300s of no message),
  *  goal-capture (persist the first user message as the goal),
  *  passive-context (drain passive backlog as pre-text on the next message),
- *  context-intro (inject the <crtr-context> bearings block — carrying the
- *  <knowledge> catalog — as its own session message, once per brand-new chat),
- *  doc-substrate (the unified document substrate's two hooks: <preferences> +
- *  <memory-guidance> at boot, on-read context injection), commands (the /promote slash-command), resume (the /resume-node
- *  whole-canvas picker → `crtr node focus`), view (the /view popup → `crtr
- *  view pick` / `crtr view run <name>`).
+ *  context-intro (inject the <crtr-bearings> block + the <memory kind="knowledge">
+ *  catalog as its own session message, once per brand-new chat),
+ *  doc-substrate (the unified document substrate's two hooks: the
+ *  <memory kind="preference"> block at boot, on-read context injection).
  *  All self-gate on CRTR_NODE_ID. goal-capture precedes passive-context so it
  *  reads the raw user text. */
 export declare const CANVAS_EXTENSIONS: string[];
-/** The named capability tiers a caller picks with `--model`, in descending
- *  strength. Each maps to a concrete pi model spec. `strong`/`medium`/`light`
- *  resolve to the latest opus/sonnet/haiku; `ultra` to the frontier model. */
-export declare const MODEL_TIERS: Record<string, string>;
-/** Resolve a model token to the spec pi gets via `--model`. A named tier
- *  (ultra/strong/medium/light) maps to its concrete spec; a bare family alias
- *  (sonnet/opus/haiku) maps to that family's current versioned id; anything
- *  with a `/` or an unknown name passes through. */
+/** Env var naming the DEFAULT provider for an UNqualified bare strength only.
+ *  `CRTR_MODEL_PROVIDER=openai` (case-insensitive) makes a bare `strong` resolve
+ *  on the OpenAI ladder; anything else defaults to Anthropic. A configured
+ *  defaultProvider in config.json wins over this env. */
+export declare const OPENAI_PROVIDER_ENV = "CRTR_MODEL_PROVIDER";
+export interface EquivalentProviderModel {
+    fromProvider: ModelProvider;
+    toProvider: ModelProvider;
+    strength: ModelStrength;
+    model: string;
+}
+/** Map a concrete ladder model back to its provider×strength cell, then return
+ *  the other configured provider's model at the same strength. `failedProviders`
+ *  is per-turn state: once a provider has produced a retryable outage error, do
+ *  not bounce back to it or keep reattempting the same failed provider. */
+export declare function equivalentOtherProviderModel(currentModel: string, failedProviders?: ReadonlySet<ModelProvider>): EquivalentProviderModel | null;
+/** Resolve a persona/caller `model:` token to the concrete `model:thinking`
+ *  spec pi gets via `--model`, in order:
+ *   1. `provider/rest` — apply strength aliases to `rest`; if `provider` is
+ *      `anthropic`/`openai` AND `rest` is a strength, return that ladder cell
+ *      (the word `openai` maps to the openai-codex ladder). Otherwise it is a
+ *      concrete `provider/id` (incl. any `:thinking` suffix) → pass through.
+ *   2. Bare strength (incl. aliases normal/weak) → the default-provider ladder
+ *      cell (config default provider, then CRTR_MODEL_PROVIDER, else anthropic).
+ *   3. Bare family alias (opus/sonnet/haiku) → the Anthropic ladder's
+ *      strong/medium/light, ALWAYS anthropic (ignores the env/config default).
+ *   4. Anything else → pass through unchanged. */
 export declare function normalizeModel(model: string): string;
 /** Compose a node's full pi launch recipe from its persona. The system prompt
  *  is composed from FOUR inputs: kind×mode (the persona body) plus lifecycle
@@ -49,7 +64,6 @@ export declare function buildLaunchSpec(kind: string, mode: Mode, opts: {
 }): {
     launch: LaunchSpec;
     lifecycle: 'terminal' | 'resident';
-    skills: string[];
 };
 export interface PiInvocation {
     /** argv after the `pi` binary. */

package/dist/core/runtime/launch.js

@@ -6,13 +6,15 @@
 // (keeps its conversation), or fresh (against the context dir) for a refresh-yield.
 // The spec is rewritten on every polymorph (base→orchestrator) so a node
 // always comes back as its *current* self.
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { readConfig, configPath as userConfigPath } from '../config.js';
 import { resolve as resolvePersona } from '../personas/index.js';
 import { nodeEnv } from './nodes.js';
 import { editorLabel } from '../canvas/index.js';
 import { nodeDir } from '../canvas/paths.js';
+import { defaultScopeConfig } from '../../types.js';
 // ---------------------------------------------------------------------------
 // The two canvas pi-extensions every node loads. They self-gate on the live
 // {kind,mode} env, so the worker→orchestrator polymorph flips hook behavior
@@ -34,21 +36,16 @@ export const CANVAS_GOAL_CAPTURE_PATH = resolveExtension('canvas-goal-capture');
 export const CANVAS_PASSIVE_CONTEXT_PATH = resolveExtension('canvas-passive-context');
 export const CANVAS_CONTEXT_INTRO_PATH = resolveExtension('canvas-context-intro');
 export const CANVAS_DOC_SUBSTRATE_PATH = resolveExtension('canvas-doc-substrate');
-export const CANVAS_COMMANDS_PATH = resolveExtension('canvas-commands');
-export const CANVAS_RESUME_PATH = resolveExtension('canvas-resume');
-export const CANVAS_VIEW_PATH = resolveExtension('canvas-view');
 /** The canvas extensions every node loads, in order: stophook (routing +
  *  telemetry + session-id capture), inbox-watcher (wake), nav (in-editor
  *  graph chrome), recap (the per-node inactivity recap card — Haiku over the
  *  conversation, shown above the manager line after 300s of no message),
  *  goal-capture (persist the first user message as the goal),
  *  passive-context (drain passive backlog as pre-text on the next message),
- *  context-intro (inject the <crtr-context> bearings block — carrying the
- *  <knowledge> catalog — as its own session message, once per brand-new chat),
- *  doc-substrate (the unified document substrate's two hooks: <preferences> +
- *  <memory-guidance> at boot, on-read context injection), commands (the /promote slash-command), resume (the /resume-node
- *  whole-canvas picker → `crtr node focus`), view (the /view popup → `crtr
- *  view pick` / `crtr view run <name>`).
+ *  context-intro (inject the <crtr-bearings> block + the <memory kind="knowledge">
+ *  catalog as its own session message, once per brand-new chat),
+ *  doc-substrate (the unified document substrate's two hooks: the
+ *  <memory kind="preference"> block at boot, on-read context injection).
  *  All self-gate on CRTR_NODE_ID. goal-capture precedes passive-context so it
  *  reads the raw user text. */
 export const CANVAS_EXTENSIONS = [
@@ -60,37 +57,141 @@ export const CANVAS_EXTENSIONS = [
     CANVAS_PASSIVE_CONTEXT_PATH,
     CANVAS_CONTEXT_INTRO_PATH,
     CANVAS_DOC_SUBSTRATE_PATH,
-    CANVAS_COMMANDS_PATH,
-    CANVAS_RESUME_PATH,
-    CANVAS_VIEW_PATH,
 ];
-/** The named capability tiers a caller picks with `--model`, in descending
- *  strength. Each maps to a concrete pi model spec. `strong`/`medium`/`light`
- *  resolve to the latest opus/sonnet/haiku; `ultra` to the frontier model. */
-export const MODEL_TIERS = {
-    ultra: 'anthropic/claude-fable-5',
-    strong: 'anthropic/claude-opus-4-8',
-    medium: 'anthropic/claude-sonnet-4-6',
-    light: 'anthropic/claude-haiku-4-5',
-};
-/** Bare family aliases → the same concrete versioned ids as the tiers. These
- *  MUST be real registry ids (see `pi --list-models`): an unversioned spec like
- *  `anthropic/sonnet` is NOT in the registry and silently falls back to the SDK
- *  default (opus), so it can never be the resolution target. */
-const BARE_ALIASES = {
-    opus: 'anthropic/claude-opus-4-8',
-    sonnet: 'anthropic/claude-sonnet-4-6',
-    haiku: 'anthropic/claude-haiku-4-5',
+// ---------------------------------------------------------------------------
+// Two-axis model resolution: (provider × strength) → concrete `model:thinking`.
+//
+// A persona declares ONE `model:` field valued `provider/strength` (e.g.
+// `openai/strong`, `anthropic/light`). The provider is a fixed per-persona
+// property; the caller/persona thinks only in strength; the concrete model id
+// AND the thinking level both fall out of the per-provider ladder below. The
+// ladder itself and the default provider are user-configurable in config.json;
+// pi accepts the `:thinking` suffix on `--model` (off,minimal,low,medium,high,
+// xhigh — confirmed via `pi --help`), so the resolved spec is exactly the
+// string buildPiArgv passes to `--model`; no extra launch plumbing.
+// ---------------------------------------------------------------------------
+/** Cached user config for model resolution. The launch path is hot and reads
+ *  config synchronously, so cache the merged config and invalidate on mtime/size
+ *  changes rather than rereading on every normalizeModel/buildLaunchSpec call. */
+let cachedUserConfig = null;
+function readUserConfigCached() {
+    const path = userConfigPath('user');
+    if (path === null)
+        return defaultScopeConfig();
+    try {
+        const stat = statSync(path);
+        if (cachedUserConfig !== null &&
+            cachedUserConfig.path === path &&
+            cachedUserConfig.mtimeMs === stat.mtimeMs &&
+            cachedUserConfig.size === stat.size) {
+            return cachedUserConfig.config;
+        }
+        const config = readConfig('user');
+        cachedUserConfig = { path, mtimeMs: stat.mtimeMs, size: stat.size, config };
+        return config;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            cachedUserConfig = null;
+            return defaultScopeConfig();
+        }
+        throw error;
+    }
+}
+const DEFAULT_MODEL_LADDERS = defaultScopeConfig().modelLadders;
+function modelLadders() {
+    return readUserConfigCached().modelLadders ?? DEFAULT_MODEL_LADDERS;
+}
+function ladderFor(provider, ladders = modelLadders()) {
+    return ladders[provider];
+}
+/** Env var naming the DEFAULT provider for an UNqualified bare strength only.
+ *  `CRTR_MODEL_PROVIDER=openai` (case-insensitive) makes a bare `strong` resolve
+ *  on the OpenAI ladder; anything else defaults to Anthropic. A configured
+ *  defaultProvider in config.json wins over this env. */
+export const OPENAI_PROVIDER_ENV = 'CRTR_MODEL_PROVIDER';
+function defaultProvider() {
+    const cfgProvider = readUserConfigCached().modelLadders.defaultProvider;
+    if (cfgProvider === 'anthropic' || cfgProvider === 'openai')
+        return cfgProvider;
+    return (process.env[OPENAI_PROVIDER_ENV] ?? '').toLowerCase() === 'openai' ? 'openai' : 'anthropic';
+}
+/** Strength synonyms accepted from personas/callers. */
+const STRENGTH_ALIASES = {
+    ultra: 'ultra',
+    strong: 'strong',
+    medium: 'medium',
+    light: 'light',
+    normal: 'medium',
+    weak: 'light',
 };
-/** Resolve a model token to the spec pi gets via `--model`. A named tier
- *  (ultra/strong/medium/light) maps to its concrete spec; a bare family alias
- *  (sonnet/opus/haiku) maps to that family's current versioned id; anything
- *  with a `/` or an unknown name passes through. */
+const MODEL_PROVIDER_KEYS = ['anthropic', 'openai'];
+const MODEL_STRENGTHS = ['ultra', 'strong', 'medium', 'light'];
+const THINKING_SUFFIXES = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh']);
+function stripThinkingSuffix(spec) {
+    const i = spec.lastIndexOf(':');
+    if (i <= 0)
+        return spec;
+    return THINKING_SUFFIXES.has(spec.slice(i + 1)) ? spec.slice(0, i) : spec;
+}
+/** Map a concrete ladder model back to its provider×strength cell, then return
+ *  the other configured provider's model at the same strength. `failedProviders`
+ *  is per-turn state: once a provider has produced a retryable outage error, do
+ *  not bounce back to it or keep reattempting the same failed provider. */
+export function equivalentOtherProviderModel(currentModel, failedProviders = new Set()) {
+    const ladders = modelLadders();
+    const currentComparable = stripThinkingSuffix(normalizeModel(currentModel));
+    for (const fromProvider of MODEL_PROVIDER_KEYS) {
+        for (const strength of MODEL_STRENGTHS) {
+            if (stripThinkingSuffix(ladders[fromProvider][strength]) !== currentComparable)
+                continue;
+            if (failedProviders.has(fromProvider))
+                return null;
+            const toProvider = fromProvider === 'anthropic' ? 'openai' : 'anthropic';
+            if (failedProviders.has(toProvider))
+                return null;
+            return { fromProvider, toProvider, strength, model: ladders[toProvider][strength] };
+        }
+    }
+    return null;
+}
+/** Resolve a persona/caller `model:` token to the concrete `model:thinking`
+ *  spec pi gets via `--model`, in order:
+ *   1. `provider/rest` — apply strength aliases to `rest`; if `provider` is
+ *      `anthropic`/`openai` AND `rest` is a strength, return that ladder cell
+ *      (the word `openai` maps to the openai-codex ladder). Otherwise it is a
+ *      concrete `provider/id` (incl. any `:thinking` suffix) → pass through.
+ *   2. Bare strength (incl. aliases normal/weak) → the default-provider ladder
+ *      cell (config default provider, then CRTR_MODEL_PROVIDER, else anthropic).
+ *   3. Bare family alias (opus/sonnet/haiku) → the Anthropic ladder's
+ *      strong/medium/light, ALWAYS anthropic (ignores the env/config default).
+ *   4. Anything else → pass through unchanged. */
 export function normalizeModel(model) {
-    if (model in MODEL_TIERS)
-        return MODEL_TIERS[model];
-    if (model in BARE_ALIASES)
-        return BARE_ALIASES[model];
+    const ladders = modelLadders();
+    // 1. Qualified provider/rest.
+    if (model.includes('/')) {
+        const slash = model.indexOf('/');
+        const provider = model.slice(0, slash);
+        const rest = model.slice(slash + 1);
+        const strength = STRENGTH_ALIASES[rest];
+        if (strength !== undefined && (provider === 'anthropic' || provider === 'openai')) {
+            return ladderFor(provider, ladders)[strength];
+        }
+        // Concrete `provider/id` (optionally `...:thinking`) — pass through.
+        return model;
+    }
+    // 2. Bare strength → default-provider ladder.
+    const strength = STRENGTH_ALIASES[model];
+    if (strength !== undefined)
+        return ladderFor(defaultProvider(), ladders)[strength];
+    // 3. Bare family alias → always Anthropic.
+    if (model === 'opus')
+        return ladders.anthropic.strong;
+    if (model === 'sonnet')
+        return ladders.anthropic.medium;
+    if (model === 'haiku')
+        return ladders.anthropic.light;
+    // 4. Unknown — pass through.
     return model;
 }
 // ---------------------------------------------------------------------------
@@ -105,10 +206,14 @@ export function normalizeModel(model) {
  *  declared extensions follow. */
 export function buildLaunchSpec(kind, mode, opts) {
     const p = resolvePersona(kind, mode, { lifecycle: opts.lifecycle, hasManager: opts.hasManager });
-    // A caller-supplied override (durable on `meta.model_override`, re-passed on
-    // every polymorph) wins over the persona's declared default; absent both, the
-    // model is left unset and the node inherits pi's default.
-    const chosenModel = opts.model ?? p.model;
+    const cfg = readUserConfigCached();
+    // Precedence, from strongest to weakest:
+    // 1. Caller-supplied override (durable on `meta.model_override`, re-passed on
+    //    every polymorph).
+    // 2. Configured persona strength for this kind.
+    // 3. The persona file's own frontmatter model.
+    // 4. Unset → pi default.
+    const chosenModel = opts.model ?? cfg.personaStrengths[kind] ?? p.model;
     const launch = {
         model: chosenModel !== undefined ? normalizeModel(chosenModel) : undefined,
         tools: p.tools,
@@ -116,7 +221,7 @@ export function buildLaunchSpec(kind, mode, opts) {
         systemPrompt: p.systemPrompt,
         env: { ...(opts.extraEnv ?? {}) },
     };
-    return { launch, lifecycle: p.lifecycle, skills: p.skills };
+    return { launch, lifecycle: p.lifecycle };
 }
 // ---------------------------------------------------------------------------
 // Build the pi argv to launch / revive a node

package/dist/core/runtime/model-swap.d.ts

@@ -0,0 +1,18 @@
+import { type NodeMeta } from '../canvas/index.js';
+/** True when the node's broker engine is reachable: its recorded pid is alive
+ *  AND its view.sock exists. Both are required — a dead pid with a stale socket,
+ *  or a live pid mid-boot before it binds the socket, is NOT a live broker. */
+export declare function isBrokerLive(meta: NodeMeta): boolean;
+/** Swap a LIVE node's model over its view.sock. Connects, claims controller
+ *  (hello + request_control, so an attached viewer never blocks the swap), sends
+ *  `set_model`, and resolves with the broker-resolved `provider/id` on its ack —
+ *  read back from the row the broker just persisted (model_changed.model carries
+ *  only the bare id). Rejects with the broker's message on an `error` frame (e.g.
+ *  `no model matching '<spec>' in the registry`), on connect failure, or timeout. */
+export declare function setModelLive(nodeId: string, spec: string): Promise<string>;
+/** Persist a model choice into a DORMANT node's durable recipe — mirrors exactly
+ *  what the broker's persistModelChoice writes on a live switch: `model_override`
+ *  (so polymorphs preserve it via buildLaunchSpec) and `launch.model` (the recipe
+ *  buildPiArgv replays on revive). `spec` must already be a concrete `provider/id`
+ *  (normalizeModel maps tiers/aliases; a bare substring cannot resolve offline). */
+export declare function persistDormantModel(nodeId: string, spec: string): void;

package/dist/core/runtime/model-swap.js

@@ -0,0 +1,95 @@
+// model-swap.ts — the engine behind `crtr node model`: swap a node's model
+// (and thus its provider) WITHOUT attaching a viewer, persisting the choice so
+// it survives revives. Two paths, chosen on broker liveness:
+//
+//   LIVE   — the node's broker is up (recorded pi_pid alive AND view.sock
+//            present): connect to view.sock, claim controller, send `set_model`,
+//            await the ack. The broker's broadcastModelChanged already persists
+//            the choice via persistModelChoice (model_override + launch.model), so
+//            this path NEVER writes the recipe itself — it reads back the resolved
+//            provider/id from the freshly-updated row.
+//   DORMANT — no live broker: write the durable recipe directly (mirroring exactly
+//            what persistModelChoice writes) so the next revive picks it up.
+//
+// This complements the in-viewer `/model` slash command for the headless case.
+import { existsSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { getNode, updateNode } from '../canvas/index.js';
+import { viewSocketPath } from '../canvas/paths.js';
+import { isPidAlive } from '../canvas/pid.js';
+import { ViewSocketClient } from './view-socket-client.js';
+/** How long to wait for the broker's `set_model` ack before giving up. The
+ *  switch is local (engine method + a DB write), so this is generous slack. */
+const ACK_TIMEOUT_MS = 15_000;
+/** True when the node's broker engine is reachable: its recorded pid is alive
+ *  AND its view.sock exists. Both are required — a dead pid with a stale socket,
+ *  or a live pid mid-boot before it binds the socket, is NOT a live broker. */
+export function isBrokerLive(meta) {
+    return isPidAlive(meta.pi_pid) && existsSync(viewSocketPath(meta.node_id));
+}
+/** Swap a LIVE node's model over its view.sock. Connects, claims controller
+ *  (hello + request_control, so an attached viewer never blocks the swap), sends
+ *  `set_model`, and resolves with the broker-resolved `provider/id` on its ack —
+ *  read back from the row the broker just persisted (model_changed.model carries
+ *  only the bare id). Rejects with the broker's message on an `error` frame (e.g.
+ *  `no model matching '<spec>' in the registry`), on connect failure, or timeout. */
+export function setModelLive(nodeId, spec) {
+    return new Promise((resolve, reject) => {
+        const client = new ViewSocketClient(nodeId);
+        const clientId = randomUUID();
+        let settled = false;
+        let resolvedId;
+        const timer = setTimeout(() => finish(() => reject(new Error(`timed out after ${ACK_TIMEOUT_MS}ms waiting for the broker to ack the model switch`))), ACK_TIMEOUT_MS);
+        if (typeof timer.unref === 'function')
+            timer.unref();
+        function finish(act) {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                client.close();
+            }
+            catch { /* best-effort */ }
+            act();
+        }
+        client.on('error', (err) => finish(() => reject(err)));
+        client.on('close', () => finish(() => reject(new Error('broker connection closed before it acked the model switch'))));
+        client.on('connect', () => {
+            // Claim control unconditionally: hello admits us as controller only if none
+            // is held; request_control preempts an attached viewer (idempotent when we
+            // already hold it). The broker processes these in order before set_model.
+            client.send({ type: 'hello', role: 'controller', client_id: clientId });
+            client.send({ type: 'request_control' });
+            client.send({ type: 'set_model', model: spec });
+        });
+        client.on('frame', (frame) => {
+            if (frame.type === 'model_changed') {
+                resolvedId = frame.model;
+            }
+            else if (frame.type === 'ack' && frame.for === 'set_model' && frame.ok) {
+                // The broker persisted model_override (full provider/id) in
+                // broadcastModelChanged BEFORE flushing these frames, so the row is
+                // authoritative; fall back to the bare id, then the raw spec.
+                const persisted = getNode(nodeId)?.model_override ?? undefined;
+                finish(() => resolve(persisted ?? resolvedId ?? spec));
+            }
+            else if (frame.type === 'error') {
+                finish(() => reject(new Error(frame.message)));
+            }
+        });
+        client.connect();
+    });
+}
+/** Persist a model choice into a DORMANT node's durable recipe — mirrors exactly
+ *  what the broker's persistModelChoice writes on a live switch: `model_override`
+ *  (so polymorphs preserve it via buildLaunchSpec) and `launch.model` (the recipe
+ *  buildPiArgv replays on revive). `spec` must already be a concrete `provider/id`
+ *  (normalizeModel maps tiers/aliases; a bare substring cannot resolve offline). */
+export function persistDormantModel(nodeId, spec) {
+    const meta = getNode(nodeId);
+    if (meta === null)
+        return;
+    const launch = meta.launch !== undefined ? { ...meta.launch, model: spec } : undefined;
+    updateNode(nodeId, { model_override: spec, ...(launch !== undefined ? { launch } : {}) });
+}

package/dist/core/runtime/naming.d.ts

@@ -16,3 +16,10 @@ export declare function slugFromPrompt(prompt: string): string;
  *  pi.setSessionName(editorLabel(meta)) so the LIVE editor label updates in the
  *  same session, instead of waiting for the next revive/cycle. */
 export declare function generateAndPersistName(nodeId: string, prompt: string, onNamed?: (meta: NodeMeta) => void): void;
+/** A filesystem-safe slug for the `.todos/<slug>.md` fallback path: lowercase,
+ *  [a-z0-9] kept, everything else → single hyphen, clamped to 8 words. */
+export declare function titleSlug(title: string): string;
+/** Ask pi headlessly for a one-line issue title for `note`. Resolves to the
+ *  generated title, or a local first-line fallback on any failure (non-zero
+ *  exit, timeout, empty output). Async; never throws. */
+export declare function generateIssueTitle(note: string): Promise<string>;