@crouton-kit/crouter 0.3.66 → 0.3.67

package/dist/core/view/transport-remote.js

@@ -0,0 +1,53 @@
+// transport-remote.ts — the Node-side remote exec transport for a
+// RemoteCanvasSource. POSTs a SourceRequest to a Blaxel preview endpoint's
+// `/__crtr/source` route (the SAME in-guest source-fulfillment endpoint the
+// browser/web transport already speaks), bearer-authed with the relay token.
+//
+// This is the ONLY way RemoteCanvasSource reaches the remote canvas: it never
+// reads a remote SQLite file, and it never invokes an in-guest command that
+// doesn't already exist. Every argv it sends is `crtr --json <existing
+// subcommand>` — read-only.
+/** The remote read plane crosses a network boundary — a stalled TCP connection
+ *  or a hung `/__crtr/source` handler must fail closed, not wedge `node
+ *  inspect`/`canvas browse`/attach forever. Low enough that a genuinely hung
+ *  endpoint surfaces as a failed read within one interactive frame, not a
+ *  silent hang. */
+const DEFAULT_TIMEOUT_MS = 5_000;
+export function createRemoteExec(previewEndpoint, relayToken, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    // A malformed stored token (control chars / non-Latin1 bytes) would throw
+    // from the Headers constructor with the invalid value IN the thrown
+    // message — validate up front so that never happens, and fail with a
+    // GENERIC message instead (Phase 3 review Minor 1: no token bytes may ever
+    // reach returned stderr). HTTP header values are ISO-8859-1; reject
+    // anything outside `/^[\x20-\x7e]+$/` (printable ASCII, no CR/LF/control).
+    const tokenValid = /^[\x20-\x7e]+$/.test(relayToken);
+    return async function exec(bin, args) {
+        if (!tokenValid) {
+            return { ok: false, stdout: '', stderr: 'remote source: invalid stored relay token' };
+        }
+        const req = { kind: 'exec', bin, args };
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        let res;
+        try {
+            res = await fetch(new URL('/__crtr/source', previewEndpoint), {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', authorization: `Bearer ${relayToken}` },
+                body: JSON.stringify(req),
+                signal: controller.signal,
+            });
+        }
+        catch (e) {
+            if (controller.signal.aborted) {
+                return { ok: false, stdout: '', stderr: `remote source: timeout after ${timeoutMs}ms` };
+            }
+            return { ok: false, stdout: '', stderr: 'remote source: network error' };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (!res.ok)
+            return { ok: false, stdout: '', stderr: `remote source: HTTP ${res.status} ${res.statusText}` };
+        return (await res.json());
+    };
+}

package/dist/types.d.ts

@@ -138,10 +138,10 @@ export interface ScopeConfig {
      *  entries at the same scope precedence as the rest of `ScopeConfig`. */
     kinds: Record<string, KindConfig>;
     /** Named remote-canvas targets for `crtr surface attach to <id> --canvas
-     *  <name>` (Phase 1 interim contract — hand-edited in config.json, no CLI
-     *  verbs yet; Phase 3 owns the real secret-store-backed `crtr canvas
-     *  config`/`crtr canvas use`). Unset via `sys config set` — not in
-     *  `TOP_LEVEL_KEYS`. */
+     *  <name>`, `crtr node inspect list/show --canvas <name>`, and `crtr canvas
+     *  browse --canvas <name>` — registered/managed via `crtr canvas config
+     *  add/list/show/remove` and selected durably via `crtr canvas use`. Unset
+     *  via `sys config set` — not in `TOP_LEVEL_KEYS`. */
     remoteCanvas: RemoteCanvasConfig;
     /** Extra env-var names/globs a scope explicitly admits across the broker
      *  spawn-env boundary (`buildBrokerEnv`, `core/runtime/spawn-env.ts`) — the
@@ -154,14 +154,17 @@ export interface ScopeConfig {
     };
 }
 /** One remote canvas target: where to relay-attach and how to find its
- *  bearer token. The token itself is NEVER stored here — only the name of an
- *  environment variable holding it, resolved at connect time by
- *  `resolveRemoteCanvasTarget` (`src/core/view/remote-canvas-target.ts`). */
+ *  bearer token. The token itself is NEVER stored here — only a ref into the
+ *  0600 secrets store, resolved at connect time by `resolveRemoteCanvasTarget`
+ *  (`src/core/view/remote-canvas-target.ts`) via `getRelayToken`
+ *  (`src/core/secrets.ts`). */
 export interface RemoteCanvasTarget {
     previewEndpoint: string;
-    /** Name of an environment variable holding the raw relay/bearer token —
-     *  NEVER the token itself. Resolved from process.env at connect time. */
-    relayTokenEnv: string;
+    /** Name/ref under which the raw token is stored in secrets.json — NEVER the
+     *  token itself. Resolved via `getRelayToken` (`core/secrets.ts`) at connect
+     *  time. Defaults to the target name at creation but is a distinct field so
+     *  a future rename doesn't orphan the secret. */
+    relayTokenRef: string;
     cpOrigin?: string;
 }
 export interface RemoteCanvasConfig {
@@ -176,6 +179,11 @@ export interface ScopeState {
     }>;
     last_self_check?: string;
     bootstrap_done?: boolean;
+    /** The name of the remote canvas target `crtr canvas use` last selected
+     *  (see `RemoteCanvasConfig`), or `null`/omitted for local. Read by
+     *  `resolveCanvasSource` (`core/canvas/source.ts`) as the durable fallback
+     *  when a command's own `--canvas` flag is absent. */
+    activeCanvas?: string | null;
 }
 export interface SubagentFrontmatter {
     name: string;
@@ -244,7 +252,7 @@ export declare const PROFILE_DIR = "profiles";
 export declare const DEFAULT_MAX_PANES_PER_WINDOW = 3;
 export declare function defaultScopeConfig(): ScopeConfig;
 /** No remote canvas targets are configured out of the box — every one is
- *  hand-added to config.json (Phase 1 interim contract, see `RemoteCanvasConfig`). */
+ *  registered via `crtr canvas config add` (see `RemoteCanvasConfig`). */
 export declare function defaultRemoteCanvasConfig(): RemoteCanvasConfig;
 /** The builtin kind registry (spec §1.5): the built-in defaults for every
  *  top-level kind and its sub-persona kinds. `whenToUse`/`model` are the

package/dist/types.js

@@ -36,7 +36,7 @@ export function defaultScopeConfig() {
     };
 }
 /** No remote canvas targets are configured out of the box — every one is
- *  hand-added to config.json (Phase 1 interim contract, see `RemoteCanvasConfig`). */
+ *  registered via `crtr canvas config add` (see `RemoteCanvasConfig`). */
 export function defaultRemoteCanvasConfig() {
     return { targets: {} };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crouton-kit/crouter",
-  "version": "0.3.66",
+  "version": "0.3.67",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",