@crouton-kit/crouter 0.3.61 → 0.3.63

package/dist/core/profiles/manifest.js

@@ -7,7 +7,7 @@
 // straight into `join(profilesRoot(), value)`.
 import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
-import { dirname, join, resolve as resolvePath, sep } from 'node:path';
+import { dirname, join, relative, resolve as resolvePath, sep } from 'node:path';
 import { SCHEMA_VERSION, PROFILE_DIR } from '../../types.js';
 import { userScopeRoot, resetScopeCache } from '../scope.js';
 import { ensureDir, nowIso } from '../fs-utils.js';
@@ -21,6 +21,14 @@ import { usage, notFound, ambiguous, general } from '../errors.js';
  *  chars. The char class alone rules out `/`, `\`, `.`, and `..` segments —
  *  this is the "generated id shape" check every exact-id lookup requires. */
 const ID_SHAPE = /^[a-z0-9]+(?:-[a-z0-9]+)*-[0-9a-f]{8}$/;
+export const ROOT_PROFILE_ID = 'root-00000000';
+const ROOT_PROFILE_NAME = 'root';
+function scaffoldProfile(profileId, manifest) {
+    const root = profileRoot(profileId);
+    ensureDir(root);
+    ensureDir(join(root, 'memory'));
+    writeManifestAtomic(profileManifestPath(profileId), manifest);
+}
 export function profilesRoot() {
     return join(userScopeRoot(), PROFILE_DIR);
 }
@@ -39,8 +47,11 @@ function assertSafeProfileId(profileId) {
  *  guard, and is what makes an unexpected symlink under a profile dir inert. */
 function assertInsideProfilesRoot(path) {
     const root = profilesRoot();
-    const resolvedRoot = existsSync(root) ? realpathSync(root) : resolvePath(root);
-    const resolvedPath = existsSync(path) ? realpathSync(path) : resolvePath(path);
+    const absRoot = resolvePath(root);
+    const resolvedRoot = existsSync(root) ? realpathSync(root) : absRoot;
+    const resolvedPath = existsSync(path)
+        ? realpathSync(path)
+        : resolvePath(resolvedRoot, relative(absRoot, resolvePath(path)));
     if (resolvedPath !== resolvedRoot && !resolvedPath.startsWith(resolvedRoot + sep)) {
         throw usage(`profile path escapes the profiles root: ${path}`);
     }
@@ -233,6 +244,31 @@ function generateProfileId(name) {
 // resetScopeCache() when they can change project dirs or the profile name
 // (never for a bare last-used-at touch).
 // ---------------------------------------------------------------------------
+export function ensureRootProfile() {
+    return withProfileManifestLock(ROOT_PROFILE_ID, () => {
+        const manifestPath = profileManifestPath(ROOT_PROFILE_ID);
+        const manifestExists = existsSync(manifestPath);
+        const manifest = manifestExists ? readManifestFile(manifestPath) : null;
+        if (manifestExists && manifest === null) {
+            throw general(`root profile manifest is unreadable: ${manifestPath}`);
+        }
+        if (manifest !== null) {
+            ensureDir(profileRoot(ROOT_PROFILE_ID));
+            ensureDir(profileMemoryDir(ROOT_PROFILE_ID));
+            return { profileId: ROOT_PROFILE_ID, manifest };
+        }
+        const next = {
+            schema_version: SCHEMA_VERSION,
+            name: ROOT_PROFILE_NAME,
+            projects: [],
+            created_at: nowIso(),
+            last_used_at: nowIso(),
+        };
+        scaffoldProfile(ROOT_PROFILE_ID, next);
+        resetScopeCache();
+        return { profileId: ROOT_PROFILE_ID, manifest: next };
+    });
+}
 export function createProfile(name, projects = []) {
     const trimmed = name.trim();
     if (trimmed === '')
@@ -240,9 +276,6 @@ export function createProfile(name, projects = []) {
     const resolvedProjects = dedupeOrdered(projects.map(resolveExistingProjectDir));
     const profileId = generateProfileId(trimmed);
     return withProfileManifestLock(profileId, () => {
-        const root = profileRoot(profileId);
-        ensureDir(root);
-        ensureDir(join(root, 'memory'));
         const manifest = {
             schema_version: SCHEMA_VERSION,
             name: trimmed,
@@ -250,7 +283,7 @@ export function createProfile(name, projects = []) {
             created_at: nowIso(),
             last_used_at: null,
         };
-        writeManifestAtomic(profileManifestPath(profileId), manifest);
+        scaffoldProfile(profileId, manifest);
         resetScopeCache();
         return { profileId, manifest };
     });

package/dist/core/profiles/select.d.ts

@@ -27,7 +27,7 @@ export declare function profileCoversCwd(entry: ProfileEntry, cwd: string): bool
  *         is covered). Default is the MRU covering profile.
  *       - Non-interactive: auto-pick the MRU covering profile, no prompt.
  *  4. Else — nothing covers cwd walking all the way up. Interactive: prompt to
- *     create a profile here or proceed as root (root lives ONLY here). Non-
- *     interactive (no TTY): default to root (null) and print the recovery
- *     instruction to STDERR — never stdout, which the caller may be piping. */
-export declare function selectProfileForCwd(cwd: string, explicitProfile?: string | null, forcePicker?: boolean): Promise<string | null>;
+ *     create a profile here or use the root profile. Non-interactive (no TTY):
+ *     default to the root profile and print the recovery instruction to STDERR —
+ *     never stdout, which the caller may be piping. */
+export declare function selectProfileForCwd(cwd: string, explicitProfile?: string | null, forcePicker?: boolean): Promise<string>;

package/dist/core/profiles/select.js

@@ -10,7 +10,7 @@ import { existsSync, realpathSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, resolve as resolvePath, sep } from 'node:path';
 import { createInterface } from 'node:readline/promises';
-import { listProfiles, loadProfileManifest, updateProfileLastUsed, createProfile, addProfileProject, } from './manifest.js';
+import { listProfiles, loadProfileManifest, updateProfileLastUsed, createProfile, addProfileProject, ensureRootProfile, } from './manifest.js';
 import { getDefaultProfileId, setDefaultProfileId, clearDefaultProfile, } from './default-binding.js';
 import { stdoutColor } from '../output.js';
 /** Resolve cwd to an absolute, realpath'd form so it compares against the
@@ -132,9 +132,9 @@ function optionRow(k, label, detail, isDefault, defaultText = 'default') {
 function caret(hint) {
     return `  ${accent('\u203a')} ${dim(hint)} `;
 }
-function recoveryMessage(cwd) {
-    return (`crtr: no profile covers ${cwd}, and this session is non-interactive — starting without a profile (root).\n` +
-        `Run \`crtr profile new --name <name> --project ${cwd}\` to create one, or pass --profile <id-or-name> next time.\n`);
+function rootProfileMessage(cwd) {
+    return (`crtr: no profile covers ${cwd}, and this session is non-interactive — using the root profile.\n` +
+        `Run \`crtr profile new --name <name> --project ${cwd}\` to create a dedicated profile, or pass --profile <id-or-name> next time.\n`);
 }
 /** The one synchronous (pre-boot) decision point: no profile covers cwd, and
  *  the session IS interactive. Ask on the controlling terminal — create a
@@ -184,11 +184,11 @@ async function promptCreateOrRoot(cwd) {
     try {
         writeHeader('No profile covers this directory');
         process.stdout.write(optionRow('c', 'create a profile here', '', false));
-        process.stdout.write(optionRow('r', dim('run without a profile (root)'), '', true));
+        process.stdout.write(optionRow('r', dim('use the root profile'), '', true));
         process.stdout.write('\n');
         const choice = (await rl.question(caret('[c/r]'))).trim().toLowerCase();
         if (choice !== 'c' && choice !== 'create')
-            return null;
+            return ensureRootProfile().profileId;
         return await createProfileHere(rl, cwd);
     }
     finally {
@@ -296,9 +296,9 @@ async function promptPickProfileOrCreate(candidates, cwd, exact, pinnedId) {
  *         is covered). Default is the MRU covering profile.
  *       - Non-interactive: auto-pick the MRU covering profile, no prompt.
  *  4. Else — nothing covers cwd walking all the way up. Interactive: prompt to
- *     create a profile here or proceed as root (root lives ONLY here). Non-
- *     interactive (no TTY): default to root (null) and print the recovery
- *     instruction to STDERR — never stdout, which the caller may be piping. */
+ *     create a profile here or use the root profile. Non-interactive (no TTY):
+ *     default to the root profile and print the recovery instruction to STDERR —
+ *     never stdout, which the caller may be piping. */
 export async function selectProfileForCwd(cwd, explicitProfile, forcePicker = false) {
     const resolvedCwd = resolveCwd(cwd);
     if (explicitProfile !== undefined && explicitProfile !== null && explicitProfile !== '') {
@@ -349,8 +349,9 @@ export async function selectProfileForCwd(cwd, explicitProfile, forcePicker = fa
             updateProfileLastUsed(winner.profileId);
             return winner.profileId;
         }
-        process.stderr.write(recoveryMessage(resolvedCwd));
-        return null;
+        const root = ensureRootProfile();
+        process.stderr.write(rootProfileMessage(resolvedCwd));
+        return root.profileId;
     }
     // Interactive. Several exact claimants → choose among them. Else covered from
     // a parent/workspace dir → menu of covering profiles. Else nothing covers →
@@ -361,7 +362,6 @@ export async function selectProfileForCwd(cwd, explicitProfile, forcePicker = fa
         : covering.length > 0
             ? await promptPickProfileOrCreate(covering, resolvedCwd, false, validPinnedId)
             : await promptCreateOrRoot(resolvedCwd);
-    if (chosen !== null)
-        updateProfileLastUsed(chosen);
+    updateProfileLastUsed(chosen);
     return chosen;
 }

package/dist/core/runtime/__tests__/spawn-env.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/runtime/__tests__/spawn-env.test.js

@@ -0,0 +1,268 @@
+// Run with: node --import tsx/esm --test src/core/runtime/__tests__/spawn-env.test.ts
+//
+// Regression lock for the C-1 spawn-env boundary (`../spawn-env.ts`): the
+// broker child env is CONSTRUCTED from a default-deny allowlist, never
+// inherited via `{ ...process.env }`. Each case below reproduces one clause of
+// the contract so a future edit that re-opens the leak (or re-admits `GIT_*`
+// / a credentialed proxy, or resolves `spawnEnv.allow` from the wrong scope)
+// fails loud here instead of silently in prod.
+import { test, before, after, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync, realpathSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { resetScopeCache } from '../../scope.js';
+import { readMergedLaunchConfig } from '../../config.js';
+import { buildOperationalEnvBase, buildBrokerEnv } from '../spawn-env.js';
+const LEAK_CLASS_HOST_ENV = {
+    HOME: '/Users/tester',
+    PATH: '/usr/bin:/bin',
+    LANG: 'en_US.UTF-8',
+    XDG_CONFIG_HOME: '/Users/tester/.config',
+    PI_CODING_AGENT_DIR: '/Users/tester/.pi',
+    // The C-1 leak class: ambient third-party credentials that must never cross.
+    MISTRAL_API_KEY: 'fake-m',
+    GOOGLE_GENERATIVE_AI_API_KEY: 'fake-g',
+    GITHUB_TOKEN: 'fake-gh',
+    AWS_ACCESS_KEY_ID: 'fake-aws-id',
+    AWS_SECRET_ACCESS_KEY: 'fake-aws-secret',
+    // The GIT_* injection surface.
+    GIT_CONFIG_KEY_0: 'http.https://x.insteadof',
+    GIT_ASKPASS: '/tmp/fake-askpass',
+    // Proxy: one credentialed (must drop), one plain (must keep).
+    HTTP_PROXY: 'http://baduser:badpass@proxy.corp:3128',
+    HTTPS_PROXY: 'http://proxy.corp:3128',
+    NO_PROXY: 'localhost,127.0.0.1',
+    // Configured model-provider keys (source B).
+    ANTHROPIC_API_KEY: 'fake-anthropic',
+    OPENAI_API_KEY: 'fake-openai',
+};
+/** Ambient-scope helper: most cases below don't care about `spawnEnv.allow`
+ *  scoping (source C), so they resolve against whatever cwd/profile is live
+ *  when they run (an isolated empty scope by construction of `beforeEach`
+ *  below) rather than repeating `{ targetCwd, targetProfileId }` at each
+ *  call site. */
+function base(host) {
+    return buildOperationalEnvBase({ targetCwd: process.cwd(), targetProfileId: null, host });
+}
+// --- every case needs an isolated scope root so the repo's own
+// .crouter/config.json (which declares no spawnEnv) never masks a test, and
+// so `spawnEnv.allow` config can be planted per-test without cross-talk.
+let isolatedHome;
+let isolatedCwd;
+let prevHome;
+let prevCwd;
+before(() => {
+    prevHome = process.env.HOME;
+    prevCwd = process.cwd();
+});
+beforeEach(() => {
+    isolatedHome = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-spawn-env-home-')));
+    isolatedCwd = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-spawn-env-cwd-')));
+    process.env.HOME = isolatedHome;
+    process.chdir(isolatedCwd);
+    resetScopeCache();
+});
+afterEach(() => {
+    rmSync(isolatedHome, { recursive: true, force: true });
+    rmSync(isolatedCwd, { recursive: true, force: true });
+});
+after(() => {
+    process.chdir(prevCwd);
+    if (prevHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = prevHome;
+    resetScopeCache();
+});
+test('A1: literal operational names and non-secret prefixes cross verbatim', () => {
+    const env = base(LEAK_CLASS_HOST_ENV);
+    assert.equal(env.HOME, '/Users/tester');
+    assert.equal(env.PATH, '/usr/bin:/bin');
+    assert.equal(env.LANG, 'en_US.UTF-8');
+    assert.equal(env.XDG_CONFIG_HOME, '/Users/tester/.config');
+    assert.equal(env.PI_CODING_AGENT_DIR, '/Users/tester/.pi');
+});
+test('leak-class ambient credentials are dropped', () => {
+    const env = base(LEAK_CLASS_HOST_ENV);
+    assert.equal(env.MISTRAL_API_KEY, undefined);
+    assert.equal(env.GOOGLE_GENERATIVE_AI_API_KEY, undefined);
+    assert.equal(env.GITHUB_TOKEN, undefined);
+    assert.equal(env.AWS_ACCESS_KEY_ID, undefined);
+    assert.equal(env.AWS_SECRET_ACCESS_KEY, undefined);
+});
+test('GIT_* is dropped in full — no default admits any GIT_ variable', () => {
+    const env = base(LEAK_CLASS_HOST_ENV);
+    assert.equal(env.GIT_CONFIG_KEY_0, undefined);
+    assert.equal(env.GIT_ASKPASS, undefined);
+    assert.equal(Object.keys(env).some((k) => k.startsWith('GIT_')), false);
+});
+test('B: configured model-provider keys cross by exact name', () => {
+    const env = base(LEAK_CLASS_HOST_ENV);
+    assert.equal(env.ANTHROPIC_API_KEY, 'fake-anthropic');
+    assert.equal(env.OPENAI_API_KEY, 'fake-openai');
+});
+// ---------------------------------------------------------------------------
+// A2 — proxy userinfo guard (Major 1 fix): must reject username-only,
+// password-only, and scheme-less userinfo, for BOTH uppercase and lowercase
+// var names; must keep a plain proxy URL, for both cases; NO_PROXY always
+// keeps.
+// ---------------------------------------------------------------------------
+test('A2: a credentialed proxy URL is dropped, a plain one crosses (uppercase)', () => {
+    const env = base(LEAK_CLASS_HOST_ENV);
+    assert.equal(env.HTTP_PROXY, undefined, 'userinfo-bearing proxy must not cross');
+    assert.equal(env.HTTPS_PROXY, 'http://proxy.corp:3128', 'plain proxy crosses untouched');
+    assert.equal(env.NO_PROXY, 'localhost,127.0.0.1');
+});
+test('A2: password-only proxy authority is dropped (http://:pass@host)', () => {
+    const env = base({ HTTP_PROXY: 'http://:badpass@proxy.corp:3128' });
+    assert.equal(env.HTTP_PROXY, undefined, 'a naive `username === \'\'` check would wrongly admit this');
+});
+test('A2: username-only proxy authority is dropped (http://user@host)', () => {
+    const env = base({ HTTP_PROXY: 'http://baduser@proxy.corp:3128' });
+    assert.equal(env.HTTP_PROXY, undefined);
+});
+test('A2: scheme-less userinfo is dropped, not silently normalized then admitted', () => {
+    // `new URL('user:pass@proxy.corp:3128')` parses "user" as a CUSTOM scheme
+    // with empty username/password — the exact hole the naive check missed.
+    const env = base({ HTTP_PROXY: 'user:pass@proxy.corp:3128' });
+    assert.equal(env.HTTP_PROXY, undefined);
+});
+test('A2: lowercase proxy vars get the same guard — credentialed drops, plain keeps', () => {
+    const env = base({
+        http_proxy: 'http://baduser:badpass@proxy.corp:3128',
+        https_proxy: 'http://proxy.corp:3128',
+        no_proxy: 'localhost',
+    });
+    assert.equal(env.http_proxy, undefined, 'lowercase credentialed proxy must not cross');
+    assert.equal(env.https_proxy, 'http://proxy.corp:3128', 'lowercase plain proxy crosses');
+    assert.equal(env.no_proxy, 'localhost');
+});
+test('A2: a non-http(s) scheme or hostless value is dropped, never admitted', () => {
+    const env = base({ HTTP_PROXY: 'not a url at all' });
+    assert.equal(env.HTTP_PROXY, undefined);
+});
+// ---------------------------------------------------------------------------
+// buildBrokerEnv: overlay + drop the leak class through the real process.env
+// path.
+// ---------------------------------------------------------------------------
+test('buildBrokerEnv overlays inv.env + FRONT_DOOR_ENV on top of the sanitized base, and drops the leak class', () => {
+    const inv = {
+        argv: [],
+        env: { CRTR_NODE_ID: 'n1', CRTR_CONTEXT_DIR: '/ctx', CRTR_NODE_CWD: isolatedCwd, CRTR_PROFILE_ID: '' },
+    };
+    // Mutate individual keys and delete them back out afterward — NEVER
+    // reassign `process.env` wholesale (`process.env = {...}`), which detaches
+    // it from the real OS environment binding (e.g. breaks `os.homedir()` for
+    // every test that runs after it in this same process).
+    try {
+        process.env.MISTRAL_API_KEY = 'fake-m';
+        process.env.GIT_ASKPASS = '/tmp/fake-askpass';
+        const env = buildBrokerEnv(inv);
+        assert.equal(env.CRTR_NODE_ID, 'n1', 'trusted inv.env overlay present');
+        assert.equal(env.CRTR_CONTEXT_DIR, '/ctx');
+        assert.equal(env.CRTR_FRONT_DOOR, '1', 'fork-bomb recursion guard set');
+        assert.equal(env.MISTRAL_API_KEY, undefined, 'ambient leak class still absent through the real process.env path');
+        assert.equal(env.GIT_ASKPASS, undefined, 'GIT_* still absent through the real process.env path');
+    }
+    finally {
+        delete process.env.MISTRAL_API_KEY;
+        delete process.env.GIT_ASKPASS;
+    }
+});
+// ---------------------------------------------------------------------------
+// C — explicit spawnEnv.allow escape hatch: literal names + globs.
+// ---------------------------------------------------------------------------
+test('C: an explicit spawnEnv.allow literal name admits a var that would otherwise be dropped', () => {
+    mkdirSync(join(isolatedHome, '.crouter'), { recursive: true });
+    writeFileSync(join(isolatedHome, '.crouter', 'config.json'), JSON.stringify({ spawnEnv: { allow: ['GOOGLE_GENERATIVE_AI_API_KEY'] } }));
+    resetScopeCache();
+    const env = base(LEAK_CLASS_HOST_ENV);
+    assert.equal(env.GOOGLE_GENERATIVE_AI_API_KEY, 'fake-g', 'explicitly allowlisted name now crosses');
+    assert.equal(env.MISTRAL_API_KEY, undefined, 'every other leak-class name stays absent — the hatch is scoped, not a blanket reopen');
+    assert.equal(env.GIT_ASKPASS, undefined);
+});
+test('C (glob, Minor fix): AWS_* admits only AWS_-prefixed names, nothing else', () => {
+    mkdirSync(join(isolatedHome, '.crouter'), { recursive: true });
+    writeFileSync(join(isolatedHome, '.crouter', 'config.json'), JSON.stringify({ spawnEnv: { allow: ['AWS_*'] } }));
+    resetScopeCache();
+    const env = base(LEAK_CLASS_HOST_ENV);
+    assert.equal(env.AWS_ACCESS_KEY_ID, 'fake-aws-id', 'AWS_-prefixed name admitted by the glob');
+    assert.equal(env.AWS_SECRET_ACCESS_KEY, 'fake-aws-secret', 'a second AWS_-prefixed name is also admitted');
+    assert.equal(env.MISTRAL_API_KEY, undefined, 'the glob must not admit unrelated names');
+    assert.equal(env.GIT_ASKPASS, undefined);
+});
+test('C (glob, Minor fix): a bare "*" (inherit-all) is rejected loud at config read, not silently accepted or dropped', () => {
+    mkdirSync(join(isolatedCwd, '.crouter'), { recursive: true });
+    writeFileSync(join(isolatedCwd, '.crouter', 'config.json'), JSON.stringify({ spawnEnv: { allow: ['*'] } }));
+    resetScopeCache();
+    assert.throws(() => readMergedLaunchConfig(isolatedCwd, null), /matches every env var name/, 'a bare "*" must fail loud at config read, per cto-rejects-fallback-hedges — never silently literal, never silently dropped');
+});
+// ---------------------------------------------------------------------------
+// Major 2 fix — spawnEnv.allow resolves from the TARGET's own cwd/profile,
+// never the calling/launcher process's ambient scope.
+// ---------------------------------------------------------------------------
+test('target-scope: spawnEnv.allow is read from the TARGET cwd, not process.cwd() (the ambient/launcher cwd)', () => {
+    const launcherCwd = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-spawn-env-launcher-')));
+    const targetCwd = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-spawn-env-target-')));
+    try {
+        // The LAUNCHER's own cwd declares an allowlist entry — this must NOT leak
+        // into a target with a different cwd (the verified C-1 follow-up leak:
+        // "a broker for target cwd B admitted AWS_ACCESS_KEY_ID solely because
+        // the launcher cwd A had it in spawnEnv.allow").
+        mkdirSync(join(launcherCwd, '.crouter'), { recursive: true });
+        writeFileSync(join(launcherCwd, '.crouter', 'config.json'), JSON.stringify({ spawnEnv: { allow: ['AWS_ACCESS_KEY_ID'] } }));
+        process.chdir(launcherCwd); // simulate: ambient process.cwd() is the LAUNCHER's, not the target's
+        resetScopeCache();
+        const envAgainstUnrelatedTarget = buildOperationalEnvBase({ targetCwd, targetProfileId: null, host: LEAK_CLASS_HOST_ENV });
+        assert.equal(envAgainstUnrelatedTarget.AWS_ACCESS_KEY_ID, undefined, "the launcher's own cwd allowlist must not admit into an unrelated target");
+        // Now give the TARGET's own cwd the allow entry instead (ambient
+        // process.cwd() is STILL the launcher's — unchanged) and confirm it takes
+        // effect purely because it is the passed target scope.
+        mkdirSync(join(targetCwd, '.crouter'), { recursive: true });
+        writeFileSync(join(targetCwd, '.crouter', 'config.json'), JSON.stringify({ spawnEnv: { allow: ['AWS_ACCESS_KEY_ID'] } }));
+        resetScopeCache();
+        const envAgainstOwnTarget = buildOperationalEnvBase({ targetCwd, targetProfileId: null, host: LEAK_CLASS_HOST_ENV });
+        assert.equal(envAgainstOwnTarget.AWS_ACCESS_KEY_ID, 'fake-aws-id', "the TARGET's own cwd allowlist takes effect regardless of the ambient/launcher cwd");
+    }
+    finally {
+        rmSync(launcherCwd, { recursive: true, force: true });
+        rmSync(targetCwd, { recursive: true, force: true });
+        resetScopeCache();
+    }
+});
+test('target-scope: buildBrokerEnv resolves spawnEnv.allow from inv.env.CRTR_NODE_CWD (the revive/spawn target), not this process\'s ambient cwd', () => {
+    const launcherCwd = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-spawn-env-launcher2-')));
+    const targetCwd = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-spawn-env-target2-')));
+    try {
+        mkdirSync(join(targetCwd, '.crouter'), { recursive: true });
+        writeFileSync(join(targetCwd, '.crouter', 'config.json'), JSON.stringify({ spawnEnv: { allow: ['MISTRAL_API_KEY'] } }));
+        process.chdir(launcherCwd); // this process's ambient cwd is unrelated to the target — mirrors the daemon reviving a node from its OWN cwd
+        resetScopeCache();
+        process.env.MISTRAL_API_KEY = 'fake-m';
+        try {
+            const inv = { argv: [], env: { CRTR_NODE_ID: 'n2', CRTR_NODE_CWD: targetCwd, CRTR_PROFILE_ID: '' } };
+            const env = buildBrokerEnv(inv);
+            assert.equal(env.MISTRAL_API_KEY, 'fake-m', "the TARGET node's own cwd allowlist (from inv.env.CRTR_NODE_CWD) takes effect on a broker launch — this is what revive/triggered spawn goes through");
+        }
+        finally {
+            delete process.env.MISTRAL_API_KEY;
+        }
+    }
+    finally {
+        rmSync(launcherCwd, { recursive: true, force: true });
+        rmSync(targetCwd, { recursive: true, force: true });
+        resetScopeCache();
+    }
+});
+test('target-scope: spawnEnv.allow is read from the TARGET profile id, not this process\'s ambient CRTR_PROFILE_ID', () => {
+    const profileId = 'testprof-aaaaaaaa'; // must match the profile-id shape (<slug>-<8-hex>)
+    const profileDir = join(isolatedHome, '.crouter', 'profiles', profileId);
+    mkdirSync(profileDir, { recursive: true });
+    writeFileSync(join(profileDir, 'config.json'), JSON.stringify({ spawnEnv: { allow: ['AWS_ACCESS_KEY_ID'] } }));
+    resetScopeCache();
+    const withoutTargetProfile = buildOperationalEnvBase({ targetCwd: isolatedCwd, targetProfileId: null, host: LEAK_CLASS_HOST_ENV });
+    assert.equal(withoutTargetProfile.AWS_ACCESS_KEY_ID, undefined, 'no profile passed — the profile-scoped allow must not apply');
+    const withTargetProfile = buildOperationalEnvBase({ targetCwd: isolatedCwd, targetProfileId: profileId, host: LEAK_CLASS_HOST_ENV });
+    assert.equal(withTargetProfile.AWS_ACCESS_KEY_ID, 'fake-aws-id', "passing the TARGET's own profile id resolves that profile's allowlist");
+});

package/dist/core/runtime/bearings.d.ts

@@ -13,10 +13,11 @@ export declare function contextDirNote(nodeId: string): string;
  *  manifest that names at least one project dir. Phrased as PURVIEW, not a cwd
  *  replacement: the node's cwd is still its one working dir (bash/edits run
  *  there), the profile just widens what it may ALSO read/act on. Omitted
- *  entirely for a root/no-profile node or a deleted/unreadable manifest —
- *  never throws (mirrors `assembleNodeSubject`'s profile resolution). This
- *  absolute-path disclosure is intentional (spec-approved): the agent must
- *  know its full purview, not a redacted count. */
+ *  entirely for a profile with no project purview (including the stable root
+ *  profile) or a deleted/unreadable manifest — never throws (mirrors
+ *  `assembleNodeSubject`'s profile resolution). This absolute-path disclosure
+ *  is intentional (spec-approved): the agent must know its full purview, not a
+ *  redacted count. */
 export declare function profileNote(nodeId: string): string;
 /** Orchestrator-only framing: a resident orchestrator survives refresh cycles,
  *  so its context dir is also where a future cycle of itself resumes the work.

package/dist/core/runtime/bearings.js

@@ -43,6 +43,7 @@ import { readdirSync } from 'node:fs';
 import { cadenceDisplay } from '../wake.js';
 import { renderKnowledgeBlock } from '../substrate/index.js';
 import { loadProfileManifest } from '../profiles/manifest.js';
+import { situationalContextBlock } from './situational-context.js';
 function escapeAttribute(value) {
     return value.replaceAll('&', '&amp;').replaceAll('"', '&quot;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
 }
@@ -142,10 +143,11 @@ export function contextDirNote(nodeId) {
  *  manifest that names at least one project dir. Phrased as PURVIEW, not a cwd
  *  replacement: the node's cwd is still its one working dir (bash/edits run
  *  there), the profile just widens what it may ALSO read/act on. Omitted
- *  entirely for a root/no-profile node or a deleted/unreadable manifest —
- *  never throws (mirrors `assembleNodeSubject`'s profile resolution). This
- *  absolute-path disclosure is intentional (spec-approved): the agent must
- *  know its full purview, not a redacted count. */
+ *  entirely for a profile with no project purview (including the stable root
+ *  profile) or a deleted/unreadable manifest — never throws (mirrors
+ *  `assembleNodeSubject`'s profile resolution). This absolute-path disclosure
+ *  is intentional (spec-approved): the agent must know its full purview, not a
+ *  redacted count. */
 export function profileNote(nodeId) {
     const meta = getNode(nodeId);
     const profileId = meta?.profile_id;
@@ -376,7 +378,7 @@ export function buildContextBearings(nodeId) {
     if (map !== '')
         bearings.push('', '## Your place in the canvas', map);
     bearings.push('', '## Your context directory', contextDirNote(nodeId));
-    // Profile purview — omitted entirely for a root/no-profile node (see profileNote).
+    // Profile purview — omitted entirely when there is no project purview (see profileNote).
     const profileSection = profileNote(nodeId);
     if (profileSection !== '')
         bearings.push('', profileSection);
@@ -390,6 +392,10 @@ export function buildContextBearings(nodeId) {
     bearings.push('</crtr-bearings>');
     // The consultable catalog rides BESIDE the bearings, not inside them.
     const knowledge = renderKnowledgeBlock(nodeId);
+    // Hidden applet/situation-origin ambient context (see situational-context.ts)
+    // — a SIBLING block, never nested under <crtr-bearings>, and never routed
+    // through the visible chat/digest path. '' when nothing was ever set.
+    const situational = situationalContextBlock(nodeId);
     const projectCtx = node?.cwd !== undefined ? buildProjectContextBlock(node.cwd) : '';
-    return [bearings.join('\n'), knowledge, projectCtx].filter((s) => s !== '').join('\n');
+    return [bearings.join('\n'), knowledge, situational, projectCtx].filter((s) => s !== '').join('\n');
 }

package/dist/core/runtime/broker.js

@@ -28,7 +28,7 @@ import { FRONT_DOOR_ENV } from './front-door.js';
 import { equivalentOtherProviderModel, normalizeModel, piInvocationToSdkConfig, } from './launch.js';
 import { assertEngineVersion, loadBrokerEngine } from './broker-sdk.js';
 import { classify } from '../fault-classifier.js';
-import { isModelNotFoundError, readFault, recordFault } from './fault.js';
+import { isModelNotFoundError, readFault, recordFault, recordFaultForCurrentNode } from './fault.js';
 import { CONNECTION_FAULT_RECOVERY_BODY, PROVIDER_FAULT_RECOVERY_BODY } from './fault-recovery-nudge.js';
 import { markFatalOnExhaust, nextFaultRetry, policyFor } from './fault-recovery.js';
 import { probeOnline as probeOnlineReal } from './connectivity.js';
@@ -1717,6 +1717,27 @@ export async function buildBrokerSession(engine, cfg) {
         // 3. Resolve the model spec (`anthropic/sonnet` → a Model) against the
         //    SERVICES registry — which has any extension-provided providers (C3).
         //    Undefined ⇒ the SDK picks the settings default.
+        // M-9: describe the AUTHENTICATED set for a fault message, and a helper to
+        // record a durable fault + abort the session build — never a silent
+        // SDK-default fallback. The throw propagates out of buildBrokerSession to
+        // runBroker's caller (broker-cli), which logs it and exits non-zero BEFORE
+        // session_start; crtrd's boot-failure grace then transitions the node to
+        // 'dead' (transition(id, 'crash')) — an operator-visible fault, not a
+        // warning buried in broker.log.
+        const describeAvailableModels = () => {
+            const available = services.modelRegistry.getAvailable().map((m) => `${m.provider}/${m.id}`);
+            return available.length > 0 ? available.join(', ') : '(none — no provider has valid credentials)';
+        };
+        const faultAndDie = (message) => {
+            recordFaultForCurrentNode({
+                link: 'crtr→pi',
+                op: 'model resolution at launch',
+                kind: 'model-not-found',
+                retry: { disposition: 'fatal' },
+                message,
+            });
+            throw new Error(`[broker] FATAL: ${message}`);
+        };
         let model;
         let thinkingLevel;
         if (cfg.model !== undefined && cfg.model !== '') {
@@ -1724,15 +1745,46 @@ export async function buildBrokerSession(engine, cfg) {
             thinkingLevel = parsedModel.thinkingLevel;
             const slash = parsedModel.modelSpec.indexOf('/');
             if (slash > 0) {
-                model = services.modelRegistry.find(parsedModel.modelSpec.slice(0, slash), parsedModel.modelSpec.slice(slash + 1));
-                if (model === undefined) {
-                    process.stderr.write(`[broker] WARNING: model '${cfg.model}' not found in registry — ` +
-                        `falling back to the SDK default model.\n`);
+                const provider = parsedModel.modelSpec.slice(0, slash);
+                const id = parsedModel.modelSpec.slice(slash + 1);
+                // `find()` is NOT auth-filtered — it will happily return a model
+                // whose provider has no credentials configured (e.g. a registered
+                // OpenAI model on an Anthropic-OAuth-only box). Use it only as an
+                // existence check, then gate on `hasConfiguredAuth()` before ever
+                // handing the model to the SDK — otherwise launch "succeeds" and the
+                // node only fails on its first real provider call.
+                const candidate = services.modelRegistry.find(provider, id);
+                if (candidate === undefined) {
+                    faultAndDie(`model '${cfg.model}' not registered. ` +
+                        `Available (authenticated): ${describeAvailableModels()}`);
+                }
+                else if (!services.modelRegistry.hasConfiguredAuth(candidate)) {
+                    faultAndDie(`model '${cfg.model}' is registered but its provider '${provider}' has no configured credentials. ` +
+                        `Available (authenticated): ${describeAvailableModels()}`);
                 }
+                else {
+                    model = candidate;
+                }
+            }
+            else {
+                faultAndDie(`model '${cfg.model}' has no 'provider/id' form and cannot be resolved. ` +
+                    `Available: ${describeAvailableModels()}`);
+            }
+        }
+        else {
+            // M-9 criterion 1: no explicit/kind-default model was resolved by
+            // launch.ts. Left as `undefined`, the SDK's own findInitialModel would try
+            // a *settings* default next (a provider/id saved in settings.json) via a
+            // plain registry `find()` that does NOT check auth — an unauthenticated
+            // settings default would silently become the session's model and only
+            // fail on the first real request. Skip that gap entirely: select
+            // explicitly from the AUTHENTICATED set ourselves, or fault.
+            const available = services.modelRegistry.getAvailable();
+            if (available.length === 0) {
+                faultAndDie('no model specified and no authenticated model is available (no provider has valid credentials)');
             }
             else {
-                process.stderr.write(`[broker] WARNING: model '${cfg.model}' has no 'provider/id' form — ` +
-                    `using the SDK default model.\n`);
+                model = available[0];
             }
         }
         const created = await engine.createAgentSessionFromServices({

package/dist/core/runtime/fault-recovery.js

@@ -9,6 +9,10 @@ const POLICIES = {
     // deliberate agent/operator decision (kill the runaway subprocess), not a
     // provider back-off.
     wedged: { kind: 'wedged', gate: 'none', max: 0, baseDelayMs: 0, capDelayMs: 0, fatal: true },
+    // A launch-time model resolution failure (unregistered/unauthenticated spec) —
+    // never auto-retried, since retrying with the same unresolved model would just
+    // fail again identically. Fixing it requires a new --model or new credentials.
+    'model-not-found': { kind: 'model-not-found', gate: 'none', max: 0, baseDelayMs: 0, capDelayMs: 0, fatal: true },
 };
 export function policyFor(kind) {
     return POLICIES[kind];

package/dist/core/runtime/front-door.js

@@ -7,7 +7,7 @@
 //   crtr --profile <id-or-name>  → root under an explicit profile (else the
 //                                  startup selector: a per-cwd pinned default,
 //                                  else MRU covering cwd, else a synchronous
-//                                  create-or-root prompt)
+//                                  create-or-root-profile prompt)
 //   crtr --pick-profile          → force the profile chooser open even when a
 //                                  per-cwd default is pinned (to re-pin/unpin)
 //   crtr <subcommand> ...        → falls through to the normal dispatcher