@crouton-kit/crouter 0.3.66 → 0.3.68

package/dist/core/view/remote-canvas-target.d.ts

@@ -1,3 +1,4 @@
-import type { Scope } from '../../types.js';
+import type { Scope, RemoteCanvasTarget } from '../../types.js';
 import type { RelayTarget } from '../../clients/attach/transport-relay.js';
+export declare function getRemoteCanvasTarget(name: string, scope?: Scope): RemoteCanvasTarget | undefined;
 export declare function resolveRemoteCanvasTarget(name: string, scope?: Scope): RelayTarget;

package/dist/core/view/remote-canvas-target.js

@@ -2,12 +2,17 @@
 // config entry (see `RemoteCanvasTarget`, `src/types.ts`) into a `RelayTarget`
 // ready for `RelayTransport` (`src/clients/attach/transport-relay.ts`).
 //
-// The raw bearer token NEVER lives in config or argv — only the name of an
-// environment variable holding it (`relayTokenEnv`), read here at connect
-// time. This is the Phase 1 interim contract; Phase 3 owns the real
-// secret-store-backed `crtr canvas config`/`crtr canvas use` CLI.
+// The raw bearer token NEVER lives in config.json — only a ref
+// (`relayTokenRef`) into the 0600 secrets store (`src/core/secrets.ts`),
+// resolved here at connect time via `getRelayToken`. Targets are registered
+// and the token stored via `crtr canvas config add` (`--relay-token -` reads
+// it from stdin, the preferred form to keep it out of shell history).
 import { usage } from '../errors.js';
 import { readConfig } from '../config.js';
+import { getRelayToken } from '../secrets.js';
+export function getRemoteCanvasTarget(name, scope = 'user') {
+    return readConfig(scope).remoteCanvas.targets[name];
+}
 export function resolveRemoteCanvasTarget(name, scope = 'user') {
     const cfg = readConfig(scope);
     const target = cfg.remoteCanvas.targets[name];
@@ -15,11 +20,11 @@ export function resolveRemoteCanvasTarget(name, scope = 'user') {
         const known = Object.keys(cfg.remoteCanvas.targets);
         throw usage(`no remote canvas target named '${name}'` +
             (known.length > 0 ? ` — configured: ${known.join(', ')}` : ' — none configured yet') +
-            `. Add remoteCanvas.targets.${name} to config.json (run \`crtr sys config path\`): {"previewEndpoint": "https://<hash>.preview.bl.run", "relayTokenEnv": "<ENV_VAR_NAME>"}.`);
+            `. Add one with \`crtr canvas config add ${name} --preview <url> --relay-token -\`.`);
     }
-    const relayToken = process.env[target.relayTokenEnv];
+    const relayToken = getRelayToken(target.relayTokenRef, scope);
     if (relayToken === undefined || relayToken === '') {
-        throw usage(`remote canvas target '${name}' needs its relay token in $${target.relayTokenEnv} — that environment variable is unset. Export it before running this command; the token is never read from config or argv.`);
+        throw usage(`target '${name}' has no stored relay token — add it with \`crtr canvas config add ${name} --relay-token -\`.`);
     }
     return { previewEndpoint: target.previewEndpoint, relayToken };
 }

package/dist/core/view/transport-local.js

@@ -38,9 +38,18 @@ function sendExec(req, baseCwd) {
                 resolve({ ok: true, exitCode: code, stdout: stdout ?? '', stderr: stderr ?? '' });
                 return;
             }
-            if (err.signal) {
-                // Killed by signal: it ran; surface as a non-zero exit.
-                resolve({ ok: true, exitCode: 1, stdout: stdout ?? '', stderr: stderr ?? '' });
+            const signal = err.signal;
+            if (signal) {
+                // Killed by signal: it ran; surface as a non-zero exit. A SIGKILL with
+                // no stderr at all (the live-incident shape: a guest OOM killer takes
+                // out the child before it ever writes anything) used to come back as
+                // a bare `failed (1)` with nothing to explain it — the signal itself
+                // IS the useful diagnostic here, so surface it when stderr is empty
+                // rather than discarding it.
+                const detail = stderr && stderr.trim() !== ''
+                    ? stderr
+                    : `killed by signal ${signal}${signal === 'SIGKILL' ? ' (often out-of-memory)' : ''}`;
+                resolve({ ok: true, exitCode: 1, stdout: stdout ?? '', stderr: detail });
                 return;
             }
             // Spawn-level failure (ENOENT/EACCES/maxBuffer): transport failure.

package/dist/core/view/transport-remote.d.ts

@@ -0,0 +1,2 @@
+import type { RawResponse } from './contract.js';
+export declare function createRemoteExec(previewEndpoint: string, relayToken: string, timeoutMs?: number): (bin: string, args: string[]) => Promise<RawResponse>;

package/dist/core/view/transport-remote.js

@@ -0,0 +1,53 @@
+// transport-remote.ts — the Node-side remote exec transport for a
+// RemoteCanvasSource. POSTs a SourceRequest to a Blaxel preview endpoint's
+// `/__crtr/source` route (the SAME in-guest source-fulfillment endpoint the
+// browser/web transport already speaks), bearer-authed with the relay token.
+//
+// This is the ONLY way RemoteCanvasSource reaches the remote canvas: it never
+// reads a remote SQLite file, and it never invokes an in-guest command that
+// doesn't already exist. Every argv it sends is `crtr --json <existing
+// subcommand>` — read-only.
+/** The remote read plane crosses a network boundary — a stalled TCP connection
+ *  or a hung `/__crtr/source` handler must fail closed, not wedge `node
+ *  inspect`/`canvas browse`/attach forever. Low enough that a genuinely hung
+ *  endpoint surfaces as a failed read within one interactive frame, not a
+ *  silent hang. */
+const DEFAULT_TIMEOUT_MS = 5_000;
+export function createRemoteExec(previewEndpoint, relayToken, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    // A malformed stored token (control chars / non-Latin1 bytes) would throw
+    // from the Headers constructor with the invalid value IN the thrown
+    // message — validate up front so that never happens, and fail with a
+    // GENERIC message instead (Phase 3 review Minor 1: no token bytes may ever
+    // reach returned stderr). HTTP header values are ISO-8859-1; reject
+    // anything outside `/^[\x20-\x7e]+$/` (printable ASCII, no CR/LF/control).
+    const tokenValid = /^[\x20-\x7e]+$/.test(relayToken);
+    return async function exec(bin, args) {
+        if (!tokenValid) {
+            return { ok: false, stdout: '', stderr: 'remote source: invalid stored relay token' };
+        }
+        const req = { kind: 'exec', bin, args };
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        let res;
+        try {
+            res = await fetch(new URL('/__crtr/source', previewEndpoint), {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', authorization: `Bearer ${relayToken}` },
+                body: JSON.stringify(req),
+                signal: controller.signal,
+            });
+        }
+        catch (e) {
+            if (controller.signal.aborted) {
+                return { ok: false, stdout: '', stderr: `remote source: timeout after ${timeoutMs}ms` };
+            }
+            return { ok: false, stdout: '', stderr: 'remote source: network error' };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (!res.ok)
+            return { ok: false, stdout: '', stderr: `remote source: HTTP ${res.status} ${res.statusText}` };
+        return (await res.json());
+    };
+}

package/dist/types.d.ts

@@ -138,10 +138,10 @@ export interface ScopeConfig {
      *  entries at the same scope precedence as the rest of `ScopeConfig`. */
     kinds: Record<string, KindConfig>;
     /** Named remote-canvas targets for `crtr surface attach to <id> --canvas
-     *  <name>` (Phase 1 interim contract — hand-edited in config.json, no CLI
-     *  verbs yet; Phase 3 owns the real secret-store-backed `crtr canvas
-     *  config`/`crtr canvas use`). Unset via `sys config set` — not in
-     *  `TOP_LEVEL_KEYS`. */
+     *  <name>`, `crtr node inspect list/show --canvas <name>`, and `crtr canvas
+     *  browse --canvas <name>` — registered/managed via `crtr canvas config
+     *  add/list/show/remove` and selected durably via `crtr canvas use`. Unset
+     *  via `sys config set` — not in `TOP_LEVEL_KEYS`. */
     remoteCanvas: RemoteCanvasConfig;
     /** Extra env-var names/globs a scope explicitly admits across the broker
      *  spawn-env boundary (`buildBrokerEnv`, `core/runtime/spawn-env.ts`) — the
@@ -154,14 +154,17 @@ export interface ScopeConfig {
     };
 }
 /** One remote canvas target: where to relay-attach and how to find its
- *  bearer token. The token itself is NEVER stored here — only the name of an
- *  environment variable holding it, resolved at connect time by
- *  `resolveRemoteCanvasTarget` (`src/core/view/remote-canvas-target.ts`). */
+ *  bearer token. The token itself is NEVER stored here — only a ref into the
+ *  0600 secrets store, resolved at connect time by `resolveRemoteCanvasTarget`
+ *  (`src/core/view/remote-canvas-target.ts`) via `getRelayToken`
+ *  (`src/core/secrets.ts`). */
 export interface RemoteCanvasTarget {
     previewEndpoint: string;
-    /** Name of an environment variable holding the raw relay/bearer token —
-     *  NEVER the token itself. Resolved from process.env at connect time. */
-    relayTokenEnv: string;
+    /** Name/ref under which the raw token is stored in secrets.json — NEVER the
+     *  token itself. Resolved via `getRelayToken` (`core/secrets.ts`) at connect
+     *  time. Defaults to the target name at creation but is a distinct field so
+     *  a future rename doesn't orphan the secret. */
+    relayTokenRef: string;
     cpOrigin?: string;
 }
 export interface RemoteCanvasConfig {
@@ -176,6 +179,11 @@ export interface ScopeState {
     }>;
     last_self_check?: string;
     bootstrap_done?: boolean;
+    /** The name of the remote canvas target `crtr canvas use` last selected
+     *  (see `RemoteCanvasConfig`), or `null`/omitted for local. Read by
+     *  `resolveCanvasSource` (`core/canvas/source.ts`) as the durable fallback
+     *  when a command's own `--canvas` flag is absent. */
+    activeCanvas?: string | null;
 }
 export interface SubagentFrontmatter {
     name: string;
@@ -244,7 +252,7 @@ export declare const PROFILE_DIR = "profiles";
 export declare const DEFAULT_MAX_PANES_PER_WINDOW = 3;
 export declare function defaultScopeConfig(): ScopeConfig;
 /** No remote canvas targets are configured out of the box — every one is
- *  hand-added to config.json (Phase 1 interim contract, see `RemoteCanvasConfig`). */
+ *  registered via `crtr canvas config add` (see `RemoteCanvasConfig`). */
 export declare function defaultRemoteCanvasConfig(): RemoteCanvasConfig;
 /** The builtin kind registry (spec §1.5): the built-in defaults for every
  *  top-level kind and its sub-persona kinds. `whenToUse`/`model` are the

package/dist/types.js

@@ -36,7 +36,7 @@ export function defaultScopeConfig() {
     };
 }
 /** No remote canvas targets are configured out of the box — every one is
- *  hand-added to config.json (Phase 1 interim contract, see `RemoteCanvasConfig`). */
+ *  registered via `crtr canvas config add` (see `RemoteCanvasConfig`). */
 export function defaultRemoteCanvasConfig() {
     return { targets: {} };
 }