@crouton-kit/crouter 0.3.33 → 0.3.34

package/dist/core/canvas/wakeups.js

@@ -1,185 +0,0 @@
-// wakeups.ts — the WAKEUPS table data-access layer (canvas.db, migration v7).
-//
-// One-module-per-table (the focuses.ts precedent): ALL SQL that touches the
-// `wakeups` table lives HERE and nowhere else — never appended to canvas.ts,
-// which keeps the node/edge model. A WAKEUP is one durable row = "do <kind> at
-// fire_at [every recur]", carrying a fire time, a kind, an optional payload, an
-// optional recurrence cadence, a nullable TARGET node_id, and the owner_id of
-// the node that ARMED it.
-//
-// Two anchors, two reap rules (design D1/D2):
-//   - node_id  → the revive target AND the node-anchored cancel anchor; it
-//     carries the `ON DELETE CASCADE` FK, so a pruned node's node-anchored wakes
-//     are reaped FOR FREE in pruneNodes' same `DELETE FROM nodes` (canvas.ts is
-//     UNTOUCHED — the cascade does it; there is no pruneNodes wakeups code).
-//     NULL = canvas-detached (a deferred spawn / spawn-cron).
-//   - owner_id → the armer; a PLAIN indexed column with NO FK, so a crashed-
-//     then-pruned armer's detached cron is NOT cascade-dropped (Invariant E).
-//     Reaped only by the explicit cancelWakesFor DELETE on deliberate close.
-//
-// Each function is a single-statement query mirroring the canvas.ts atomic-setter
-// pattern (setStatus/setIntent/setPresence) — no read-modify-write, serialized by
-// WAL. The data-access layer OWNS payload serialization: armWake JSON.stringifies
-// the typed per-kind union on write; dueWakes/listWakes JSON.parse it back on read
-// (Maj-1), so callers consume `payload.body` / `payload as SpawnChildOpts` directly.
-//
-// `wakeup_id` is CALLER-SUPPLIED (the command surface mints `wk-${newNodeId()}`):
-// the canvas layer never imports newNodeId from runtime/nodes.ts — that would
-// force a canvas → runtime → canvas import cycle (Min-1).
-import { openDb } from './db.js';
-/** A thrown integrity-backstop error from armWake. `code` is the AC-N3 code the
- *  command surface (the ONLY sanctioned caller of armWake) maps to a rendered
- *  error block — armWake carries integrity backstops only (empty body / recur-on-
- *  deadline / unknown kind); target-resolvability + recoverable-state + the
- *  per-owner cap live in the surface (Min-6), so a non-surface armer could insert
- *  a dangling wake — every armer MUST route through the surface. */
-export class WakeArmError extends Error {
-    code;
-    constructor(code, message) {
-        super(message);
-        this.code = code;
-        this.name = 'WakeArmError';
-    }
-}
-/** Hydrate a raw row into a Wakeup, JSON.parsing `payload` back into the typed
- *  per-kind union (NULL column → null). */
-function wakeupFrom(r) {
-    const raw = r['payload'];
-    return {
-        wakeup_id: r['wakeup_id'],
-        node_id: r['node_id'] ?? null,
-        owner_id: r['owner_id'],
-        fire_at: r['fire_at'],
-        kind: r['kind'],
-        recur: r['recur'] ?? null,
-        payload: raw == null ? null : JSON.parse(raw),
-        created: r['created'],
-    };
-}
-// ---------------------------------------------------------------------------
-// Writes — each a single-statement INSERT/UPDATE/DELETE.
-// ---------------------------------------------------------------------------
-/** INSERT one wakeup row from the pinned spec, returning its (caller-supplied)
- *  `wakeup_id`. JSON.stringifies the typed `payload` union into the TEXT column
- *  and stamps `created`.
- *
- *  Deadline upsert (design Q3, "≤1 deadline per node"): for `kind === 'deadline'`
- *  the node's existing deadline is canceled first, then the new one inserted — the
- *  partial unique index `idx_wakeups_deadline` is the schema-level backstop.
- *
- *  Integrity backstops (throw WakeArmError; the surface maps the code to AC-N3):
- *   - empty/whitespace note `body` for `noted`/`deadline` → `empty_note`.
- *   - non-NULL `recur` on a `deadline`                    → `deadline_cannot_recur`.
- *   - unknown `kind`                                      → `bad_kind`.
- *  NO target-resolvability / recoverable-state / cap backstop here (Min-6). */
-export function armWake(spec) {
-    const { kind } = spec;
-    if (kind !== 'bare' && kind !== 'noted' && kind !== 'deadline' && kind !== 'spawn') {
-        throw new WakeArmError('bad_kind', `unknown wake kind: ${String(kind)}`);
-    }
-    if (kind === 'noted' || kind === 'deadline') {
-        const body = spec.payload?.body;
-        if (typeof body !== 'string' || body.trim() === '') {
-            throw new WakeArmError('empty_note', `a ${kind} wake requires a non-empty note body.`);
-        }
-    }
-    if (kind === 'deadline' && spec.recur != null) {
-        throw new WakeArmError('deadline_cannot_recur', 'a deadline wake cannot recur.');
-    }
-    // Deadline upsert: clear the node's existing deadline before inserting the new one.
-    if (kind === 'deadline' && spec.node_id != null) {
-        cancelDeadlinesFor(spec.node_id);
-    }
-    const payloadText = spec.payload == null ? null : JSON.stringify(spec.payload);
-    openDb()
-        .prepare(`INSERT INTO wakeups (wakeup_id, node_id, owner_id, fire_at, kind, recur, payload, created)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(spec.wakeup_id, spec.node_id ?? null, spec.owner_id, spec.fire_at, kind, spec.recur ?? null, payloadText, new Date().toISOString());
-    return spec.wakeup_id;
-}
-/** UPDATE the next fire time — recurrence advancement (the daemon settles a
- *  recurring row to its next slot BEFORE enacting, crash-safe; design D4). */
-export function advanceWake(wakeup_id, nextFireIso) {
-    openDb().prepare('UPDATE wakeups SET fire_at = ? WHERE wakeup_id = ?').run(nextFireIso, wakeup_id);
-}
-/** DELETE one wakeup by id — one-shot consumption (the daemon settles a one-shot
- *  row BEFORE enacting, crash-safe; design D4). */
-export function consumeWake(wakeup_id) {
-    openDb().prepare('DELETE FROM wakeups WHERE wakeup_id = ?').run(wakeup_id);
-}
-/** DELETE one wakeup by id — the explicit user/surface cancel. Idempotent:
- *  0 rows ⇒ no error (AC-C2). */
-export function cancelWake(wakeup_id) {
-    openDb().prepare('DELETE FROM wakeups WHERE wakeup_id = ?').run(wakeup_id);
-}
-/** DELETE every wake anchored to this node AND every detached wake it ARMED —
- *  deliberate close/reap (ruling A). Hooked at transition('cancel'). */
-export function cancelWakesFor(node_id) {
-    openDb()
-        .prepare('DELETE FROM wakeups WHERE node_id = ? OR owner_id = ?')
-        .run(node_id, node_id);
-}
-/** DELETE this node's one-shot self-alarms (recur IS NULL); node-anchored crons
- *  SURVIVE — finalize is the instance finishing, not a teardown of standing
- *  schedules (design Q1). Hooked at transition('finalize'). */
-export function cancelSelfAlarms(node_id) {
-    openDb().prepare('DELETE FROM wakeups WHERE node_id = ? AND recur IS NULL').run(node_id);
-}
-/** DELETE this node's pending deadline(s) — cancel-on-wake (design §6.4).
- *  Hooked at reviveNode, so the deadline always belongs to the dormancy left. */
-export function cancelDeadlinesFor(node_id) {
-    openDb().prepare("DELETE FROM wakeups WHERE node_id = ? AND kind = 'deadline'").run(node_id);
-}
-// ---------------------------------------------------------------------------
-// Reads.
-// ---------------------------------------------------------------------------
-/** The daemon's per-tick due query: every row whose fire_at has arrived, in
- *  fire_at order, with `payload` parsed into the typed union. Returns exactly ONE
- *  row per recurring wake regardless of missed slots — coalescing is structural
- *  (AC-E2). */
-export function dueWakes(nowIso) {
-    return openDb()
-        .prepare('SELECT * FROM wakeups WHERE fire_at <= ? ORDER BY fire_at')
-        .all(nowIso).map(wakeupFrom);
-}
-/** List wakes for a scope (node / owner / subtree / due / canvas), `payload`
- *  parsed as in dueWakes. The subtree variant binds the id set with `?`
- *  placeholders (mirroring listNodes — the codebase's one safe dynamic-IN spot);
- *  ids are NEVER string-concatenated (Min-10). */
-export function listWakes(scope) {
-    const db = openDb();
-    let rows;
-    if ('node' in scope) {
-        rows = db
-            .prepare('SELECT * FROM wakeups WHERE node_id = ? ORDER BY fire_at')
-            .all(scope.node);
-    }
-    else if ('owner' in scope) {
-        rows = db
-            .prepare('SELECT * FROM wakeups WHERE owner_id = ? ORDER BY fire_at')
-            .all(scope.owner);
-    }
-    else if ('subtree' in scope) {
-        if (scope.subtree.length === 0)
-            return [];
-        const placeholders = scope.subtree.map(() => '?').join(',');
-        rows = db
-            .prepare(`SELECT * FROM wakeups WHERE node_id IN (${placeholders}) ORDER BY fire_at`)
-            .all(...scope.subtree);
-    }
-    else if ('due' in scope) {
-        rows = db
-            .prepare('SELECT * FROM wakeups WHERE fire_at <= ? ORDER BY fire_at')
-            .all(scope.due);
-    }
-    else {
-        rows = db.prepare('SELECT * FROM wakeups ORDER BY fire_at').all();
-    }
-    return rows.map(wakeupFrom);
-}
-/** True if the node has ANY pending self-anchored wake (of any kind). Consumed by
- *  the stop-guard self-wake seam so a no-child poll node releases dormant after
- *  arming instead of being nagged to finish (AC-X3/AC-R1). */
-export function hasPendingSelfWake(node_id) {
-    return (openDb().prepare('SELECT 1 FROM wakeups WHERE node_id = ? LIMIT 1').get(node_id) !== undefined);
-}

package/dist/hearth/wake-proxy/__tests__/source-bridge-gate.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/hearth/wake-proxy/__tests__/source-bridge-gate.test.js

@@ -1,455 +0,0 @@
-import assert from 'node:assert/strict';
-import { createHash } from 'node:crypto';
-import { spawnSync } from 'node:child_process';
-import { linkSync, mkdtempSync, mkdirSync, realpathSync, symlinkSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { Readable } from 'node:stream';
-import { test } from 'node:test';
-import { PUBLIC_SOURCE_FILE_READ_SCRIPT, handlePublicSourceRequest } from '../public-source-gate.js';
-import { guestEnv } from '../../../core/hearth/guest-env.js';
-import { routeRequest } from '../server.js';
-const ownerToken = 'owner-secret-token';
-const ownerTokenHash = createHash('sha256').update(ownerToken, 'utf8').digest('hex');
-const publicOrigin = 'https://hearth.example';
-const guestHome = '/home/agent';
-const tenantId = 'tenant-source-gate';
-const nodeId = 'mqt64sus-e71caa94';
-function makeRuntime(statePath) {
-    return {
-        proxy: {
-            host: '127.0.0.1',
-            port: 7878,
-            publicOrigin,
-            statePath,
-            m0RegistryPath: join(statePath, 'homes.json'),
-            ownerUserId: 'owner-user',
-            defaultTenantId: tenantId,
-            ownerTokenHash,
-            idlePauseMs: 60_000,
-            wakeTimeoutMs: 30_000,
-            readyTimeoutMs: 2_000,
-            cookieSecure: true,
-            seedHome: null,
-        },
-        m0: {
-            providerName: 'none',
-            registryPath: join(statePath, 'homes.json'),
-            guestUser: 'agent',
-            guestHome,
-            guestCodePath: '/opt/crouter',
-            webPort: 7878,
-            nodeKind: 'general',
-            piPackages: [],
-            piAuthJson: null,
-            relayToken: null,
-        },
-    };
-}
-function writeState(statePath) {
-    writeFileSync(statePath, `${JSON.stringify({
-        version: 1,
-        owner: {
-            ownerUserId: 'owner-user',
-            defaultTenantId: tenantId,
-            tokenHash: ownerTokenHash,
-            createdAt: '2026-06-26T00:00:00.000Z',
-        },
-        tenants: {},
-    }, null, 2)}\n`, 'utf8');
-}
-function makeRequest(method, url, headers = {}, body = '') {
-    const req = new Readable({ read() { } });
-    req.method = method;
-    req.url = url;
-    req.headers = headers;
-    process.nextTick(() => {
-        if (body !== '')
-            req.push(body);
-        req.push(null);
-    });
-    return req;
-}
-function makeResponse() {
-    return {
-        statusCode: 200,
-        headersSent: false,
-        headers: {},
-        body: '',
-        writeHead(statusCode, headers) {
-            this.statusCode = statusCode;
-            this.headers = { ...this.headers, ...headers };
-            this.headersSent = true;
-            return this;
-        },
-        setHeader(name, value) {
-            this.headers[name.toLowerCase()] = value;
-        },
-        end(chunk) {
-            if (chunk !== undefined)
-                this.body += Buffer.isBuffer(chunk) ? chunk.toString('utf8') : chunk;
-            this.headersSent = true;
-            return this;
-        },
-        destroy() {
-            this.headersSent = true;
-        },
-    };
-}
-function parseBody(res) {
-    return JSON.parse(res.body);
-}
-function helperResult(input) {
-    const parsed = JSON.parse(String(input));
-    return parsed;
-}
-function runArtifactHelper(canvasHomePath, piAgentDirPath, artifactPath) {
-    const proc = spawnSync(process.execPath, ['--input-type=module', '-e', PUBLIC_SOURCE_FILE_READ_SCRIPT], {
-        input: JSON.stringify({ canvasHome: canvasHomePath, piAgentDir: piAgentDirPath, path: artifactPath }),
-        encoding: 'utf8',
-    });
-    return {
-        status: proc.status,
-        stdout: proc.stdout,
-        stderr: proc.stderr,
-    };
-}
-test('regression: public source gate allows stdin only on crtr node new/msg writes (fixes MAJOR 1)', async () => {
-    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-source-gate-'));
-    const statePath = join(tempDir, 'state.json');
-    writeState(statePath);
-    const runtime = makeRuntime(statePath);
-    const calls = [];
-    const allowedExecCases = [
-        { kind: 'exec', bin: 'crtr', args: ['canvas', 'snapshot', '--json'] },
-        { kind: 'exec', bin: 'crtr', args: ['node', 'inspect', 'show', nodeId, '--json'] },
-        { kind: 'exec', bin: 'crtr', args: ['node', 'snapshot', nodeId, '--json'] },
-        { kind: 'exec', bin: 'crtr', args: ['node', 'new', '--kind', 'developer', '--cwd', '/home/agent/project', '--name', 'spawned-child', '--model', 'claude-sonnet-4', '--parent', nodeId, '--json'], stdin: 'spawn prompt body' },
-        { kind: 'exec', bin: 'crtr', args: ['node', 'msg', nodeId, '--json'], stdin: 'ping the node body' },
-        { kind: 'exec', bin: 'crtr', args: ['node', 'msg', nodeId, '--tier', 'urgent', '--json'], stdin: 'ping the node with tier' },
-        { kind: 'exec', bin: 'crtr', args: ['canvas', 'revive', nodeId, '--json'] },
-        { kind: 'exec', bin: 'crtr', args: ['canvas', 'revive', nodeId, '--fresh', '--json'] },
-        { kind: 'exec', bin: 'crtr', args: ['node', 'close', '--node', nodeId, '--json'] },
-        { kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'] },
-    ];
-    const guestSource = async (_tenantId, request) => {
-        calls.push({ tenantId: _tenantId, request });
-        const typed = request;
-        if (typed.kind === 'exec' && typed.bin === 'node' && Array.isArray(typed.args) && typed.args.includes(PUBLIC_SOURCE_FILE_READ_SCRIPT)) {
-            const payload = JSON.parse(typed.stdin ?? '{}');
-            const fileContent = payload.path?.endsWith('/reports/report.md') ? 'reports artifact contents' : 'context artifact contents';
-            return {
-                ok: true,
-                exitCode: 0,
-                stdout: JSON.stringify({ ok: true, stdout: fileContent }),
-                stderr: '',
-            };
-        }
-        return {
-            ok: true,
-            exitCode: 0,
-            stdout: 'allowed exec ok',
-            stderr: '',
-        };
-    };
-    for (const request of allowedExecCases) {
-        const res = makeResponse();
-        const handled = await handlePublicSourceRequest(makeRequest('POST', '/__crtr/source', { authorization: `Bearer ${ownerToken}` }, JSON.stringify(request)), res, runtime, { guestSource });
-        assert.equal(handled, true);
-        assert.equal(res.statusCode, 200);
-        assert.deepEqual(parseBody(res), {
-            ok: true,
-            exitCode: 0,
-            stdout: 'allowed exec ok',
-            stderr: '',
-        });
-    }
-    const env = guestEnv(runtime.m0);
-    const contextPath = `${env.CRTR_HOME}/nodes/${nodeId}/context/note.md`;
-    const reportsPath = `${env.CRTR_HOME}/nodes/${nodeId}/reports/report.md`;
-    for (const filePath of [contextPath, reportsPath]) {
-        const res = makeResponse();
-        const handled = await handlePublicSourceRequest(makeRequest('POST', '/__crtr/source', { authorization: `Bearer ${ownerToken}` }, JSON.stringify({ kind: 'file', path: filePath })), res, runtime, { guestSource });
-        assert.equal(handled, true);
-        assert.equal(res.statusCode, 200);
-        assert.deepEqual(parseBody(res), {
-            ok: true,
-            stdout: filePath.endsWith('/reports/report.md') ? 'reports artifact contents' : 'context artifact contents',
-            stderr: '',
-            exitCode: 0,
-        });
-    }
-    const helperCall = calls.find((call) => {
-        const request = call.request;
-        return request.kind === 'exec' && request.bin === 'node' && Array.isArray(request.args) && request.args.includes(PUBLIC_SOURCE_FILE_READ_SCRIPT);
-    });
-    assert.ok(helperCall);
-    const helperRequest = helperCall?.request;
-    assert.ok(helperRequest.stdin);
-    const helperPayload = JSON.parse(helperRequest.stdin ?? '{}');
-    assert.equal(helperPayload.canvasHome, env.CRTR_HOME);
-    assert.equal(helperPayload.piAgentDir, env.PI_CODING_AGENT_DIR);
-    assert.ok(helperPayload.path?.startsWith(`${env.CRTR_HOME}/nodes/${nodeId}/`));
-    const invalidRequests = [
-        { kind: 'exec', bin: 'node', args: ['-v'], stdin: 'browser-supplied stdin' },
-        { kind: 'exec', bin: 'sh', args: ['-c', 'pwd'] },
-        { kind: 'exec', bin: 'git', args: ['status', '--json'], stdin: 'browser-supplied stdin' },
-        { kind: 'exec', bin: 'gh', args: ['issue', 'list', '--json'] },
-        { kind: 'exec', bin: 'capture', args: ['shot', '--json'] },
-        { kind: 'exec', bin: 'tmux', args: ['list-sessions', '--json'] },
-        { kind: 'exec', bin: 'pwd', args: ['--json'] },
-        { kind: 'exec', bin: 'crtr', args: ['canvas', 'status', '--json'] },
-        { kind: 'exec', bin: 'crtr', args: ['canvas', 'snapshot', '--extra', '--json'] },
-        { kind: 'exec', bin: 'crtr', args: ['node', 'inspect', 'show', nodeId, '--extra', '--json'] },
-        { kind: 'exec', bin: 'crtr', args: ['node', 'new', '--kind', 'developer', '--json'], stdin: 'x'.repeat(16 * 1024 + 1) },
-        { kind: 'exec', bin: 'crtr', args: ['view', 'list', '--extra', '--json'] },
-        { kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'], cwd: '/tmp' },
-        { kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'], stdin: 'browser-supplied stdin' },
-        { kind: 'exec', bin: 'crtr', args: ['node', 'close', '--node', nodeId] },
-        { kind: 'http', method: 'GET', url: 'https://example.invalid' },
-        { kind: 'file', path: `${env.PI_CODING_AGENT_DIR}/auth.json` },
-        { kind: 'file', path: '/etc/passwd' },
-        { kind: 'file', path: `${env.CRTR_HOME}/nodes/${nodeId}/context/../reports/report.md` },
-        { kind: 'file', path: `${env.CRTR_HOME}/nodes/${nodeId}/secret/x.md` },
-        { kind: 'file', path: `${env.CRTR_HOME}\\nodes\\${nodeId}\\context\\note.md` },
-    ];
-    for (const request of invalidRequests) {
-        const res = makeResponse();
-        let called = 0;
-        const handled = await handlePublicSourceRequest(makeRequest('POST', '/__crtr/source', { authorization: `Bearer ${ownerToken}` }, JSON.stringify(request)), res, runtime, {
-            guestSource: async () => {
-                called += 1;
-                throw new Error('guest should not run for rejected source requests');
-            },
-        });
-        assert.equal(handled, true);
-        assert.equal(called, 0);
-        assert.equal(res.statusCode, 403);
-    }
-});
-test('routeRequest dispatches source and model-auth before proxy fallback', async () => {
-    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-source-route-'));
-    const statePath = join(tempDir, 'state.json');
-    writeState(statePath);
-    const runtime = makeRuntime(statePath);
-    let sourceCalls = 0;
-    const sourceRes = makeResponse();
-    await routeRequest(makeRequest('POST', '/__crtr/source', { authorization: `Bearer ${ownerToken}` }, JSON.stringify({ kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'] })), sourceRes, runtime, {
-        sourceGate: {
-            guestSource: async () => {
-                sourceCalls += 1;
-                return { ok: true, exitCode: 0, stdout: 'source routed', stderr: '' };
-            },
-        },
-    });
-    assert.equal(sourceCalls, 1);
-    assert.equal(sourceRes.statusCode, 200);
-    assert.deepEqual(parseBody(sourceRes), {
-        ok: true,
-        exitCode: 0,
-        stdout: 'source routed',
-        stderr: ''
-    });
-    let modelCalls = 0;
-    const modelRes = makeResponse();
-    await routeRequest(makeRequest('GET', '/__hearth/model-auth/anthropic/status', { authorization: `Bearer ${ownerToken}` }), modelRes, runtime, {
-        modelAuth: {
-            guestSource: async () => {
-                modelCalls += 1;
-                return {
-                    ok: true,
-                    exitCode: 0,
-                    stdout: JSON.stringify({ storedOauth: false, expiresAt: null, adapterConfigured: true }),
-                    stderr: '',
-                };
-            },
-        },
-    });
-    assert.equal(modelCalls, 1);
-    assert.equal(modelRes.statusCode, 200);
-    assert.deepEqual(parseBody(modelRes), {
-        storedOauth: false,
-        expiresAt: null,
-        adapterConfigured: true,
-    });
-});
-test('public source gate enforces owner write auth and leaves non-source chat routes alone', async () => {
-    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-source-auth-'));
-    const statePath = join(tempDir, 'state.json');
-    writeState(statePath);
-    const runtime = makeRuntime(statePath);
-    let rejectedGuestCalls = 0;
-    const rejectingGuestSource = async () => {
-        rejectedGuestCalls += 1;
-        return { ok: true, exitCode: 0, stdout: 'ok', stderr: '' };
-    };
-    {
-        const res = makeResponse();
-        const handled = await handlePublicSourceRequest(makeRequest('POST', '/__crtr/source?token=' + encodeURIComponent(ownerToken), {}, JSON.stringify({ kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'] })), res, runtime, { guestSource: rejectingGuestSource });
-        assert.equal(handled, true);
-        assert.equal(rejectedGuestCalls, 0);
-        assert.equal(res.statusCode, 401);
-    }
-    {
-        rejectedGuestCalls = 0;
-        const res = makeResponse();
-        const handled = await handlePublicSourceRequest(makeRequest('POST', '/__crtr/source', {
-            cookie: `hearth_owner=${encodeURIComponent(ownerToken)}`,
-        }, JSON.stringify({ kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'] })), res, runtime, { guestSource: rejectingGuestSource });
-        assert.equal(handled, true);
-        assert.equal(rejectedGuestCalls, 0);
-        assert.equal(res.statusCode, 403);
-    }
-    {
-        const res = makeResponse();
-        const handled = await handlePublicSourceRequest(makeRequest('POST', '/__crtr/source', {
-            cookie: `hearth_owner=${encodeURIComponent(ownerToken)}`,
-            origin: publicOrigin,
-        }, JSON.stringify({ kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'] })), res, runtime, { guestSource: async () => ({ ok: true, exitCode: 0, stdout: 'ok', stderr: '' }) });
-        assert.equal(handled, true);
-        assert.equal(res.statusCode, 200);
-    }
-    {
-        const res = makeResponse();
-        const handled = await handlePublicSourceRequest(makeRequest('POST', '/__crtr/source', {
-            authorization: `Bearer ${ownerToken}`,
-        }, JSON.stringify({ kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'] })), res, runtime, { guestSource: async () => ({ ok: true, exitCode: 0, stdout: 'ok', stderr: '' }) });
-        assert.equal(handled, true);
-        assert.equal(res.statusCode, 200);
-    }
-    {
-        const res = makeResponse();
-        const handled = await handlePublicSourceRequest(makeRequest('GET', '/node/' + nodeId, { authorization: `Bearer ${ownerToken}` }), res, runtime, { guestSource: async () => ({ ok: true, exitCode: 0, stdout: 'ok', stderr: '' }) });
-        assert.equal(handled, false);
-        assert.equal(res.headersSent, false);
-    }
-});
-test('the guest artifact helper enforces realpath containment before reading', () => {
-    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-source-helper-'));
-    const canvasHomePath = join(tempDir, '.crtr-local', 'canvas');
-    const piAgentDirPath = join(tempDir, '.crtr-local', 'pi', 'agent');
-    mkdirSync(canvasHomePath, { recursive: true });
-    mkdirSync(piAgentDirPath, { recursive: true });
-    const canonicalCanvasHomePath = realpathSync(canvasHomePath);
-    const canonicalPiAgentDirPath = realpathSync(piAgentDirPath);
-    const contextDir = join(canonicalCanvasHomePath, 'nodes', nodeId, 'context');
-    const reportsDir = join(canonicalCanvasHomePath, 'nodes', nodeId, 'reports');
-    mkdirSync(contextDir, { recursive: true });
-    mkdirSync(reportsDir, { recursive: true });
-    const contextFile = join(contextDir, 'note.md');
-    const reportsFile = join(reportsDir, 'report.md');
-    writeFileSync(contextFile, 'context artifact contents', 'utf8');
-    writeFileSync(reportsFile, 'reports artifact contents', 'utf8');
-    const outsideFile = join(tempDir, 'outside.txt');
-    writeFileSync(outsideFile, 'sensitive contents', 'utf8');
-    const leakLink = join(contextDir, 'leak.md');
-    symlinkSync(outsideFile, leakLink);
-    const contextRun = runArtifactHelper(canonicalCanvasHomePath, canonicalPiAgentDirPath, contextFile);
-    assert.equal(contextRun.status, 0);
-    const contextResult = helperResult(contextRun.stdout.trim());
-    assert.equal(contextResult.ok, true);
-    assert.equal(contextResult.stdout, 'context artifact contents');
-    const reportsRun = runArtifactHelper(canonicalCanvasHomePath, canonicalPiAgentDirPath, reportsFile);
-    assert.equal(reportsRun.status, 0);
-    const reportsResult = helperResult(reportsRun.stdout.trim());
-    assert.equal(reportsResult.ok, true);
-    assert.equal(reportsResult.stdout, 'reports artifact contents');
-    const mixedSeparatorPath = `${canonicalCanvasHomePath}/nodes\\${nodeId}\\context\\note.md`;
-    const mixedSeparatorRun = runArtifactHelper(canonicalCanvasHomePath, canonicalPiAgentDirPath, mixedSeparatorPath);
-    assert.equal(mixedSeparatorRun.status, 0);
-    const mixedSeparatorResult = helperResult(mixedSeparatorRun.stdout.trim());
-    assert.equal(mixedSeparatorResult.ok, false);
-    assert.equal(mixedSeparatorResult.status, 403);
-    const leakRun = runArtifactHelper(canonicalCanvasHomePath, canonicalPiAgentDirPath, leakLink);
-    assert.equal(leakRun.status, 0);
-    const leakResult = helperResult(leakRun.stdout.trim());
-    assert.equal(leakResult.ok, false);
-    assert.equal(leakResult.status, 403);
-    assert.ok(!leakResult.error?.includes('sensitive'));
-});
-test('the guest artifact helper rejects hard-linked aliases to secrets under an allowed artifact root', () => {
-    // Regression for the hard-link alias bypass found in the public source gate.
-    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-source-helper-hardlink-'));
-    const canvasHomePath = join(tempDir, '.crtr-local', 'canvas');
-    const piAgentDirPath = join(tempDir, '.crtr-local', 'pi', 'agent');
-    mkdirSync(canvasHomePath, { recursive: true });
-    mkdirSync(piAgentDirPath, { recursive: true });
-    const canonicalCanvasHomePath = realpathSync(canvasHomePath);
-    const canonicalPiAgentDirPath = realpathSync(piAgentDirPath);
-    const contextDir = join(canonicalCanvasHomePath, 'nodes', nodeId, 'context');
-    mkdirSync(contextDir, { recursive: true });
-    const secretPath = join(piAgentDirPath, 'auth.json');
-    writeFileSync(secretPath, 'super-secret-token', 'utf8');
-    const hardLinkPath = join(contextDir, 'auth.json');
-    linkSync(secretPath, hardLinkPath);
-    const run = runArtifactHelper(canonicalCanvasHomePath, canonicalPiAgentDirPath, hardLinkPath);
-    assert.equal(run.status, 0);
-    const result = helperResult(run.stdout.trim());
-    assert.equal(result.ok, false);
-    assert.equal(result.status, 403);
-    assert.ok(!result.error?.includes('super-secret-token'));
-});
-test('the guest artifact helper rejects a symlinked nodesBase root', () => {
-    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-source-helper-nodes-base-'));
-    const canvasHomePath = join(tempDir, '.crtr-local', 'canvas');
-    const piAgentDirPath = join(tempDir, '.crtr-local', 'pi', 'agent');
-    mkdirSync(canvasHomePath, { recursive: true });
-    mkdirSync(piAgentDirPath, { recursive: true });
-    const canonicalCanvasHomePath = realpathSync(canvasHomePath);
-    const canonicalPiAgentDirPath = realpathSync(piAgentDirPath);
-    const nodesDir = join(canonicalCanvasHomePath, 'nodes');
-    mkdirSync(canonicalCanvasHomePath, { recursive: true });
-    const outsideNodes = join(tempDir, 'outside-nodes');
-    const canonicalNodeId = 'evil-node';
-    mkdirSync(join(outsideNodes, canonicalNodeId, 'context'), { recursive: true });
-    writeFileSync(join(outsideNodes, canonicalNodeId, 'context', 'note.md'), 'sensitive nodesBase contents', 'utf8');
-    symlinkSync(outsideNodes, nodesDir);
-    const run = runArtifactHelper(canonicalCanvasHomePath, canonicalPiAgentDirPath, join(nodesDir, canonicalNodeId, 'context', 'note.md'));
-    assert.equal(run.status, 0);
-    const result = helperResult(run.stdout.trim());
-    assert.equal(result.ok, false);
-    assert.equal(result.status, 403);
-    assert.ok(!result.error?.includes('sensitive'));
-});
-test('the guest artifact helper rejects symlinked roots, ancestor subdirectories, and symlinked node directories that escape the canonical nodes tree', () => {
-    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-source-helper-symlink-'));
-    const canvasHomePath = join(tempDir, '.crtr-local', 'canvas');
-    const piAgentDirPath = join(tempDir, '.crtr-local', 'pi', 'agent');
-    mkdirSync(canvasHomePath, { recursive: true });
-    mkdirSync(piAgentDirPath, { recursive: true });
-    const canonicalCanvasHomePath = realpathSync(canvasHomePath);
-    const canonicalPiAgentDirPath = realpathSync(piAgentDirPath);
-    const nodesDir = join(canonicalCanvasHomePath, 'nodes');
-    const canonicalNodeId = 'evil-node';
-    const canonicalNodeDir = join(nodesDir, canonicalNodeId);
-    mkdirSync(canonicalNodeDir, { recursive: true });
-    const assertBlockedArtifact = (artifactPath) => {
-        const run = runArtifactHelper(canonicalCanvasHomePath, canonicalPiAgentDirPath, artifactPath);
-        assert.equal(run.status, 0);
-        const result = helperResult(run.stdout.trim());
-        assert.equal(result.ok, false);
-        assert.equal(result.status, 403);
-        assert.ok(!result.error?.includes('sensitive'));
-    };
-    const contextOutside = join(tempDir, 'outside-context');
-    mkdirSync(contextOutside, { recursive: true });
-    writeFileSync(join(contextOutside, 'note.md'), 'sensitive context contents', 'utf8');
-    symlinkSync(contextOutside, join(canonicalNodeDir, 'context'));
-    assertBlockedArtifact(join(canonicalNodeDir, 'context', 'note.md'));
-    const contextSubOutside = join(tempDir, 'outside-context-sub');
-    mkdirSync(contextSubOutside, { recursive: true });
-    writeFileSync(join(contextSubOutside, 'file'), 'sensitive ancestor subdir contents', 'utf8');
-    symlinkSync(contextSubOutside, join(canonicalNodeDir, 'context', 'sub'));
-    assertBlockedArtifact(join(canonicalNodeDir, 'context', 'sub', 'file'));
-    const reportsOutside = join(tempDir, 'outside-reports');
-    mkdirSync(reportsOutside, { recursive: true });
-    writeFileSync(join(reportsOutside, 'report.md'), 'sensitive reports contents', 'utf8');
-    symlinkSync(reportsOutside, join(canonicalNodeDir, 'reports'));
-    assertBlockedArtifact(join(canonicalNodeDir, 'reports', 'report.md'));
-    const symlinkedNodeId = 'evil-node-link';
-    const outsideNodeDir = join(tempDir, 'outside-node');
-    mkdirSync(join(outsideNodeDir, 'context'), { recursive: true });
-    writeFileSync(join(outsideNodeDir, 'context', 'note.md'), 'sensitive node contents', 'utf8');
-    symlinkSync(outsideNodeDir, join(nodesDir, symlinkedNodeId));
-    assertBlockedArtifact(join(nodesDir, symlinkedNodeId, 'context', 'note.md'));
-});