@crouton-kit/crouter 0.3.66 → 0.3.68

package/dist/clients/attach/canvas-panels.js

@@ -14,6 +14,7 @@
 // read fresh for every chrome frame.
 import { beginFrame, navLabel, nodeGlyph, truncate, tokensCell, cycleBadge, askBadge, activityCell, YELLOW, RESET, DIM, GREEN, } from '../../core/canvas/nav-model.js';
 import { localCanvasSource } from '../../core/canvas/source.js';
+import { RemoteCanvasSource } from '../../core/canvas/remote-canvas-source.js';
 /** Column widths for the aligned panel rows (visible columns). name is sized to
  *  the widest label across BOTH panels (capped); kind is wide enough for the
  *  longest persona kind (`orchestrator` = 12) so real kinds never truncate;
@@ -33,6 +34,11 @@ function padStartVisible(s, w) {
  *  pending-ask map the caller polls; pass `{}` to omit the ⚑ badges. `palette`
  *  drives the headers + dim cells; omit it and the panels render uncolored. */
 export async function buildCanvasPanelLines(nodeId, asks, palette, source = localCanvasSource) {
+    // A remote source provides only graph structure + node metadata; tokens/
+    // activity/status-glyph adornments are local disk reads (telemetry.json,
+    // fault state, pid liveness) and are suppressed to safe defaults below —
+    // never read for a remote id, which may collide with a local one.
+    const remote = source instanceof RemoteCanvasSource;
     beginFrame();
     const nodes = new Map();
     const children = new Map();
@@ -132,9 +138,9 @@ export async function buildCanvasPanelLines(nodeId, asks, palette, source = loca
         const n = await node(id);
         const name = nameCell(navLabel(n, id), nameW);
         const kind = faint(nameCell(n?.kind ?? '', KIND_W));
-        const tokens = muted(padStartVisible(tokensCell(id), TOK_W));
-        const badges = `${cycleBadge(n)}${await childBadgeFor(n)}${liveBelowBadgeFor(n)}${askBadge(id, asks)}${activityCell(id, n)}`;
-        return truncate(` ${nodeGlyph(n)} ${name}  ${kind} ${tokens}${badges}`);
+        const tokens = muted(padStartVisible(tokensCell(id, remote), TOK_W));
+        const badges = `${cycleBadge(n)}${await childBadgeFor(n)}${liveBelowBadgeFor(n)}${askBadge(id, asks)}${activityCell(id, n, remote)}`;
+        return truncate(` ${nodeGlyph(n, remote)} ${name}  ${kind} ${tokens}${badges}`);
     };
     const managers = [];
     if (mgr !== undefined)

package/dist/clients/attach/graph-overlay.d.ts

@@ -21,6 +21,11 @@ export declare class GraphOverlay implements Component {
     private pendingConfirm;
     private snapshot;
     private snapshotSeq;
+    /** True when `source` is a `RemoteCanvasSource` — gates every local disk/
+     *  SQLite adornment (tokens, activity, fault, attach, focus) to a safe
+     *  default and makes Enter/m/x no-op instead of shelling local focus/kill
+     *  commands against a remote graph row. See the file header. */
+    private readonly remote;
     constructor(tui: TUI, self: string, getAsks: () => Record<string, number>, palette: AttachPalette, source?: CanvasSource);
     isOpen(): boolean;
     open(): void;

package/dist/clients/attach/graph-overlay.js

@@ -18,6 +18,16 @@
 // passes its own pane as `crtr node focus --pane <anchor>`: under the
 // one-viewer-per-node model the target's existing viewer is navigated in place,
 // or a fresh viewer opens BESIDE this pane — never a second pane for the same node.
+//
+// REMOTE mode (source instanceof RemoteCanvasSource, i.e. `attach --canvas`):
+// this overlay is READ-ONLY. Focus/kill are local-drive-plane actions and a
+// remote node id has no relationship to this machine's canvas.db, so Enter/m/x
+// no-op instead of shelling `crtr node focus`/`crtr node lifecycle close` on an
+// id that either doesn't exist locally or, worse, collides with one that does.
+// The footer hint drops the focus/kill/mgr hints accordingly, and every
+// telemetry/fault/attach/focus adornment below is suppressed to a safe default
+// (see nav-model's `remote` parameters) — the remote CanvasSource supplies
+// graph structure + node metadata ONLY.
 import { execFile } from 'node:child_process';
 import { matchesKey, truncateToWidth } from '@earendil-works/pi-tui';
 import { fullName } from '../../core/canvas/index.js';
@@ -25,6 +35,7 @@ import { activeFaultForDisplay } from '../../core/canvas/render.js';
 import { readFault } from '../../core/runtime/fault.js';
 import { faultSummary } from '../../core/canvas/status-glyph.js';
 import { localCanvasSource } from '../../core/canvas/source.js';
+import { RemoteCanvasSource } from '../../core/canvas/remote-canvas-source.js';
 import { beginFrame, navLabel, nodeGlyph, tokensCell, cycleBadge, askBadge, activityCell, focusedNodeIds, shortId, visibleWidth, fillBar, fillWidth, truncate, isAttached, VIEWPORT_FALLBACK_ROWS, DIM, RESET, BOLD, YELLOW, REVERSE, BG_ATTACHED, GREEN, } from '../../core/canvas/nav-model.js';
 // A BOUNDED, centered modal (CTO ruling: not full-bleed). Width/height are capped
 // at ~72% of the terminal; the overlay clips our lines to maxHeight, and render()
@@ -37,6 +48,8 @@ const OVERLAY_OPTIONS = { anchor: 'center', width: '72%', minWidth: 48, maxHeigh
 // host pane — the attach overlay has no such bind and swallows `e`, so the key
 // would do nothing here. Drop it.
 const GRAPH_HINT = `${DIM}jk move · hl fold · ↵ focus · x kill · m mgr · esc${RESET}`;
+// REMOTE mode drops focus/kill/mgr — Enter/m/x no-op there (see the file header).
+const GRAPH_HINT_REMOTE = `${DIM}jk move · hl fold · esc${RESET}`;
 export class GraphOverlay {
     tui;
     self;
@@ -57,12 +70,18 @@ export class GraphOverlay {
     pendingConfirm;
     snapshot;
     snapshotSeq = 0;
+    /** True when `source` is a `RemoteCanvasSource` — gates every local disk/
+     *  SQLite adornment (tokens, activity, fault, attach, focus) to a safe
+     *  default and makes Enter/m/x no-op instead of shelling local focus/kill
+     *  commands against a remote graph row. See the file header. */
+    remote;
     constructor(tui, self, getAsks, palette, source = localCanvasSource) {
         this.tui = tui;
         this.self = self;
         this.getAsks = getAsks;
         this.palette = palette;
         this.source = source;
+        this.remote = source instanceof RemoteCanvasSource;
     }
     isOpen() {
         return this.handle !== undefined;
@@ -237,7 +256,7 @@ export class GraphOverlay {
                 await walk(kids[i], childPrefix, false, i === kids.length - 1);
         };
         await walk(await climbRoot(this.self), '', true, true);
-        return { rows, activeBelow, nodes, childIds, sortedChildIds, managerOf, focused: focusedNodeIds() };
+        return { rows, activeBelow, nodes, childIds, sortedChildIds, managerOf, focused: focusedNodeIds(this.remote) };
     }
     renderSnapshotRow(snapshot, r, isCursor, asks) {
         const wrap = (line, attached) => isCursor ? fillBar(line, fillWidth(), REVERSE)
@@ -248,11 +267,11 @@ export class GraphOverlay {
             return wrap(line, false);
         }
         const node = snapshot.nodes.get(r.id) ?? null;
-        const dot = nodeGlyph(node);
+        const dot = nodeGlyph(node, this.remote);
         const rawName = navLabel(node, r.id);
         const name = r.isSelf ? `${BOLD}${rawName}${RESET}` : rawName;
         const kind = `${DIM}${node?.kind ?? ''}${RESET}`;
-        const tokens = `${DIM}${tokensCell(r.id)}${RESET}`;
+        const tokens = `${DIM}${tokensCell(r.id, this.remote)}${RESET}`;
         const expandable = r.hasKids && r.collapsed;
         const caret = !isCursor && expandable ? `${DIM}▸${RESET} ` : '  ';
         const cycle = cycleBadge(node);
@@ -261,10 +280,13 @@ export class GraphOverlay {
         const below = node !== null && node.status !== 'active' && (snapshot.activeBelow.get(node.node_id) ?? 0) > 0
             ? ` ${GREEN}⇣${snapshot.activeBelow.get(node.node_id) ?? 0}${RESET}`
             : '';
-        const fault = node !== null ? activeFaultForDisplay(node, readFault(r.id)) : null;
+        // A remote fault is a local disk read (readFault) keyed on a node id that
+        // may collide with a local one — skip it entirely rather than read-then-
+        // discard.
+        const fault = node !== null && !this.remote ? activeFaultForDisplay(node, readFault(r.id)) : null;
         const faultSuffix = fault !== null ? ` · ${faultSummary(fault)}` : '';
-        const line = `${r.branch}${caret}${dot} ${name} ${kind} ${tokens}${cycle}${child}${below}${askBadge(r.id, asks)}${activityCell(r.id, node)}${faultSuffix}`;
-        return wrap(line, isAttached(r.id, node, snapshot.focused));
+        const line = `${r.branch}${caret}${dot} ${name} ${kind} ${tokens}${cycle}${child}${below}${askBadge(r.id, asks)}${activityCell(r.id, node, this.remote)}${faultSuffix}`;
+        return wrap(line, isAttached(r.id, node, snapshot.focused, this.remote));
     }
     render(width) {
         beginFrame();
@@ -320,7 +342,7 @@ export class GraphOverlay {
             : `${BOLD}⌗ canvas graph${RESET} ${DIM}(loading)${RESET}`;
         const hint = this.pendingConfirm !== undefined
             ? `${YELLOW}${this.pendingConfirm.label} ${BOLD}y/n${RESET}`
-            : GRAPH_HINT;
+            : this.remote ? GRAPH_HINT_REMOTE : GRAPH_HINT;
         // Frame the panel: title in the top border, hint in the bottom border, tree
         // rows boxed with themed side bars (truncate/pad to the inner width so the
         // right edge stays flush and opaque).
@@ -455,13 +477,22 @@ export class GraphOverlay {
             }
             return;
         }
+        // Enter/m/x drive local lifecycle/focus (`crtr node focus` / `crtr node
+        // lifecycle close`) against `this.cursorId` — a REMOTE graph row's id has no
+        // relationship to this machine's canvas.db (or, worse, collides with one
+        // that does), so all three no-op in remote mode instead of shelling a local
+        // mutation command against a remote id. GRAPH_HINT_REMOTE drops their hints.
         if (matchesKey(data, 'enter')) {
+            if (this.remote)
+                return;
             if (this.cursorId !== undefined)
                 this.focusTarget(this.cursorId);
             this.close();
             return;
         }
         if (matchesKey(data, 'm')) {
+            if (this.remote)
+                return;
             const mgr = snapshot?.managerOf.get(this.self);
             if (mgr !== undefined) {
                 this.focusTarget(mgr);
@@ -470,6 +501,8 @@ export class GraphOverlay {
             return;
         }
         if (matchesKey(data, 'x')) {
+            if (this.remote)
+                return;
             const target = this.cursorId ?? this.self;
             const n = snapshot?.nodes.get(target) ?? null;
             const nm = n !== null ? fullName(n) : shortId(target);

package/dist/clients/attach/input-controller.d.ts

@@ -16,6 +16,11 @@ export interface InputControllerHooks {
     /** OPTIONAL: the canvas node this viewer is attached to — forwarded to the
      *  slash context so `/promote` targets it (Unit Q wires it from runAttach). */
     nodeId?: string;
+    /** OPTIONAL: true for a REMOTE attach (`crtr surface attach --canvas`) —
+     *  forwarded to the slash context so it can structurally omit/no-op the
+     *  local-only native canvas commands (`/promote`, `/resume-node`, `/context`).
+     *  Defaults to `false` (local, unchanged) when absent. */
+    remote?: boolean;
     /** OPTIONAL: toggle the GRAPH overlay — forwarded to the slash context so
      *  `/graph` opens/closes it (Unit Q wires it from runAttach). */
     onGraph?: () => void;
@@ -64,6 +69,10 @@ export declare class InputController {
     /** Timestamp of the last lone Esc, for double-tap → tree detection (0 = none). */
     private lastEscapeAt;
     constructor(tui: TUI, editor: CustomEditor, keybindings: KeybindingsManager, hooks: InputControllerHooks);
+    /** Central choke point for every command frame the input layer emits (direct
+     *  keybindings, emitDrive, and the slash-command/picker `send` sink). Local
+     *  attach (`hooks.remote` false/absent) is byte-for-byte unchanged. */
+    private emitCommand;
     /** Render extension UI requests from the broker. Blocking dialogs route their
      *  answer back to the broker; non-blocking notify requests become the viewer's
      *  normal notice line. Supersedes any dialog already on screen (e.g. a re-route

package/dist/clients/attach/input-controller.js

@@ -33,6 +33,30 @@ const DOUBLE_ESCAPE_MS = 500;
  *  split. Pasted images go to a temp file and enter the prompt as a path, never
  *  as inline base64, so a paste can no longer push a frame toward this ceiling. */
 const MAX_FRAME_BYTES = BROKER_READ_CAPS.maxLineBytes - 4 * 1024 * 1024;
+/** ClientToBroker frame types that mutate the engine/session — everything the
+ *  broker gates behind controller-only (`notController` in broker.ts) PLUS
+ *  `request_control`/`release_control` (control-claim frames; no current UI
+ *  path sends them, gated anyway for defense-in-depth) and `reload_auth`
+ *  (open to any role server-side, but viewer-local login/logout are disabled
+ *  entirely for remote below — this entry is belt-and-suspenders in case a
+ *  future path routes it through onCommand). A REMOTE attach (`--canvas`) is
+ *  a strictly VIEW-ONLY surface (Phase 3 review Major 1): even though the
+ *  broker would itself reject these from an observer, the input layer must
+ *  never even emit one — server-side rejection alone is not the contract.
+ *  `dequeue` is listed for documentation completeness even though it never
+ *  reaches `emitCommand` (it rides the separate `onRequest` read-op channel —
+ *  see `handleDequeue`'s own remote guard). Read-only frames (get_commands,
+ *  list_models, list_sessions, get_tree, get_settings, list_scoped_models)
+ *  and hello/bye/shutdown/extension_ui_response are deliberately absent —
+ *  reads stay live for remote (pickers just never get the chance to select,
+ *  see slash-commands.ts's REMOTE_SAFE_BUILTIN_NAMES gate). */
+const DRIVE_FRAME_TYPES = new Set([
+    'prompt', 'steer', 'follow_up', 'abort', 'bash',
+    'set_model', 'cycle_model', 'cycle_thinking', 'set_thinking_level', 'dequeue',
+    'set_auto_retry', 'set_auto_compaction', 'compact', 'new_session',
+    'switch_session', 'fork', 'set_session_name', 'navigate_tree', 'reload',
+    'export', 'clone', 'share', 'request_control', 'release_control', 'reload_auth',
+]);
 export class InputController {
     tui;
     editor;
@@ -56,6 +80,16 @@ export class InputController {
         this.hooks = hooks;
         this.wire();
     }
+    /** Central choke point for every command frame the input layer emits (direct
+     *  keybindings, emitDrive, and the slash-command/picker `send` sink). Local
+     *  attach (`hooks.remote` false/absent) is byte-for-byte unchanged. */
+    emitCommand(frame) {
+        if (this.hooks.remote === true && DRIVE_FRAME_TYPES.has(frame.type)) {
+            this.notify('Read-only remote attach — cannot drive the engine');
+            return;
+        }
+        this.hooks.onCommand(frame);
+    }
     /** Render extension UI requests from the broker. Blocking dialogs route their
      *  answer back to the broker; non-blocking notify requests become the viewer's
      *  normal notice line. Supersedes any dialog already on screen (e.g. a re-route
@@ -90,7 +124,7 @@ export class InputController {
         // navigate_tree path that `/tree` and app.session.tree use.
         this.editor.onEscape = () => {
             if (this.state?.isStreaming) {
-                this.hooks.onCommand({ type: 'abort' });
+                this.emitCommand({ type: 'abort' });
                 return;
             }
             if (this.editor.getText().trim())
@@ -110,10 +144,10 @@ export class InputController {
             void this.handlePaste();
         };
         // Keyboard shortcuts that map 1:1 to a frame needing no engine-side data.
-        this.editor.onAction('app.session.new', () => this.hooks.onCommand({ type: 'new_session' }));
-        this.editor.onAction('app.model.cycleForward', () => this.hooks.onCommand({ type: 'cycle_model', direction: 'forward' }));
-        this.editor.onAction('app.model.cycleBackward', () => this.hooks.onCommand({ type: 'cycle_model', direction: 'backward' }));
-        this.editor.onAction('app.thinking.cycle', () => this.hooks.onCommand({ type: 'cycle_thinking' }));
+        this.editor.onAction('app.session.new', () => this.emitCommand({ type: 'new_session' }));
+        this.editor.onAction('app.model.cycleForward', () => this.emitCommand({ type: 'cycle_model', direction: 'forward' }));
+        this.editor.onAction('app.model.cycleBackward', () => this.emitCommand({ type: 'cycle_model', direction: 'backward' }));
+        this.editor.onAction('app.thinking.cycle', () => this.emitCommand({ type: 'cycle_thinking' }));
         this.editor.onAction('app.message.followUp', () => this.handleFollowUp());
         this.editor.onAction('app.message.dequeue', () => void this.handleDequeue());
         // Pure client-side render toggles (ChatView owns the components).
@@ -131,11 +165,12 @@ export class InputController {
     }
     slashContext() {
         return {
-            send: (frame) => this.hooks.onCommand(frame),
+            send: (frame) => this.emitCommand(frame),
             notify: (message) => this.notify(message),
             state: this.state,
             cwd: process.cwd(),
             nodeId: this.hooks.nodeId,
+            remote: this.hooks.remote,
             onGraph: this.hooks.onGraph,
             onQuit: this.hooks.onQuit,
             onCopy: this.hooks.onCopy,
@@ -156,7 +191,7 @@ export class InputController {
     // (via slashContext) AND by keybinding (onAction, below).
     // -------------------------------------------------------------------------
     /** Send a command frame to the broker (picker selection sink). */
-    send = (frame) => this.hooks.onCommand(frame);
+    send = (frame) => this.emitCommand(frame);
     /** Fetch a picker payload (narrowed on `kind`), then build + show its overlay
      *  iff this open is still the latest (m4: a stale slow reply is dropped). Any
      *  failure — unwired channel, wrong kind, request error, or a throwing builder
@@ -386,6 +421,10 @@ export class InputController {
      *  (pi's `restoreQueuedMessagesToEditor`: queued text first, joined by blank
      *  lines). A read-AND-mutate op over the correlated request channel. */
     async handleDequeue() {
+        if (this.hooks.remote === true) {
+            this.notify('Read-only remote attach — cannot restore queued messages');
+            return;
+        }
         if (this.hooks.onRequest === undefined) {
             this.notify("Restoring queued messages isn't available in this viewer");
             return;
@@ -430,7 +469,7 @@ export class InputController {
             this.notify(`Message too large to send (${mib} MiB) — shorten the text or remove an attached image`);
             return false;
         }
-        this.hooks.onCommand(frame);
+        this.emitCommand(frame);
         return true;
     }
     async handlePaste() {

package/dist/clients/attach/slash-commands.d.ts

@@ -12,6 +12,13 @@ export interface SlashContext {
     state?: BrokerSnapshot['state'];
     /** cwd for the default `/export` path; defaults to `process.cwd()`. */
     cwd?: string;
+    /** True for a REMOTE attach (`crtr surface attach --canvas <name>`). The
+     *  native canvas commands that shell a LOCAL `crtr` mutation/read against
+     *  `nodeId` (`/promote`, `/resume-node`, `/context`) are meaningless — or
+     *  worse, id-colliding — for a remote node id, so `dispatchCanvasCommand`
+     *  notifies + no-ops them instead of executing (see `REMOTE_UNSAFE_CANVAS_NAMES`
+     *  below). Defaults to `false` so every existing local caller is unaffected. */
+    remote?: boolean;
     /** The canvas node this viewer is attached to — used by `/promote` (passed
      *  as `--node`). Falls back to `CRTR_NODE_ID` when absent; if neither is set
      *  `/promote` notifies and no-ops. (Unit Q wires this from `runAttach`.) */
@@ -66,14 +73,14 @@ export declare function isSlashCommand(text: string): boolean;
 export declare function dispatchSlashCommand(text: string, ctx: SlashContext): boolean;
 /** Build slash-command autocomplete entries from the merged command list (the
  *  broker's `get_commands` result, which T7 may inject) — defaults to the
- *  vendored builtins. The native canvas commands are always appended. Shaped for
- *  pi-tui's `CombinedAutocompleteProvider`. */
+ *  vendored builtins. The native canvas commands are always appended (minus the
+ *  remote-unsafe ones when `remote`). Shaped for pi-tui's `CombinedAutocompleteProvider`. */
 export declare function slashCommandList(commands?: ReadonlyArray<{
     name: string;
     description?: string;
-}>): SlashCommand[];
+}>, remote?: boolean): SlashCommand[];
 /** Same list as flat autocomplete items (value/label/description). */
 export declare function commandAutocompleteItems(commands?: ReadonlyArray<{
     name: string;
     description?: string;
-}>): AutocompleteItem[];
+}>, remote?: boolean): AutocompleteItem[];

package/dist/clients/attach/slash-commands.js

@@ -39,6 +39,14 @@ export const CANVAS_SLASH_COMMANDS = [
     { name: 'context', description: 'Browse this node + its subscriptions’ context dirs in a read-only nvim popup' },
 ];
 const CANVAS_NAMES = new Set(CANVAS_SLASH_COMMANDS.map((c) => c.name));
+/** Native canvas commands that shell a LOCAL `crtr` mutation or read against
+ *  `ctx.nodeId` — unsafe for a remote attach (Phase 3 review 2, findings-fix-
+ *  review.md §1): `/promote` shells `crtr node promote --node` locally,
+ *  `/resume-node` opens local `crtr canvas browse` whose Enter path focuses a
+ *  local node, `/context` opens local `crtr node inspect context`. `/graph`
+ *  (the in-process GRAPH overlay, already remote-safe — see graph-overlay.ts)
+ *  and `/view` (a self-contained popup unrelated to `nodeId`) stay available. */
+const REMOTE_UNSAFE_CANVAS_NAMES = new Set(['promote', 'resume-node', 'context']);
 /** Builtins with no Phase-4 engine method — scoped out (review m2). */
 const SCOPED_OUT = new Set(['trust']);
 /** Valid `/settings thinking` levels — the `SetThinkingLevelFrame['level']`
@@ -56,6 +64,17 @@ const THINKING_LEVELS = new Set(Object.keys({
     xhigh: true,
 }));
 const BUILTIN_NAMES = new Set(BUILTIN_SLASH_COMMANDS.map((c) => c.name));
+/** Builtin slash commands safe to run against a REMOTE attach (`--canvas`) —
+ *  everything else in `BUILTIN_SLASH_COMMANDS` either drives the engine
+ *  (`/model`, `/new`, `/compact`, `/name`, `/resume`, `/fork`, `/tree`,
+ *  `/settings`, `/share`, `/clone`, `/import`, `/reload`, `/scoped-models`
+ *  selection) or is viewer-local but operates on the WRONG host for a remote
+ *  node (`/login`, `/logout` — LOCAL `auth.json` via `defaultAgentDir()`, not
+ *  the remote broker's). Blocked here BEFORE the switch so a remote attach
+ *  never even opens the picker only to have the eventual selection frame
+ *  swallowed by InputController's `emitCommand` gate (defense-in-depth #2,
+ *  not the only defense — see input-controller.ts DRIVE_FRAME_TYPES). */
+const REMOTE_SAFE_BUILTIN_NAMES = new Set(['copy', 'session', 'changelog', 'hotkeys', 'quit']);
 /** True if `text` is a leading-slash command (vs. a normal prompt). */
 export function isSlashCommand(text) {
     return text.trimStart().startsWith('/');
@@ -83,6 +102,10 @@ export function dispatchSlashCommand(text, ctx) {
     // Unknown to us AND not a builtin → let the engine's extension runner have it.
     if (!BUILTIN_NAMES.has(name))
         return false;
+    if (ctx.remote === true && !REMOTE_SAFE_BUILTIN_NAMES.has(name)) {
+        ctx.notify(`/${name} is not available for a remote attach (--canvas) — view-only`);
+        return true;
+    }
     switch (name) {
         // --- direct frames -----------------------------------------------------
         case 'new':
@@ -209,21 +232,25 @@ export function dispatchSlashCommand(text, ctx) {
 /** Append the native canvas commands to a command list, skipping any already
  *  present (so they survive whatever list Unit Q feeds in — builtins, or the
  *  broker's `get_commands` result). The four canvas commands are viewer-owned,
- *  so they are always surfaced in autocomplete regardless of the source list. */
-function withCanvasCommands(commands) {
+ *  so they are always surfaced in autocomplete regardless of the source list —
+ *  EXCEPT `REMOTE_UNSAFE_CANVAS_NAMES` when `remote`, which are structurally
+ *  omitted rather than offered-then-blocked, so a remote attach's autocomplete
+ *  never advertises a command `dispatchCanvasCommand` would refuse to run. */
+function withCanvasCommands(commands, remote) {
     const seen = new Set(commands.map((c) => c.name));
-    return [...commands, ...CANVAS_SLASH_COMMANDS.filter((c) => !seen.has(c.name))];
+    const offerable = remote ? CANVAS_SLASH_COMMANDS.filter((c) => !REMOTE_UNSAFE_CANVAS_NAMES.has(c.name)) : CANVAS_SLASH_COMMANDS;
+    return [...commands, ...offerable.filter((c) => !seen.has(c.name))];
 }
 /** Build slash-command autocomplete entries from the merged command list (the
  *  broker's `get_commands` result, which T7 may inject) — defaults to the
- *  vendored builtins. The native canvas commands are always appended. Shaped for
- *  pi-tui's `CombinedAutocompleteProvider`. */
-export function slashCommandList(commands = BUILTIN_SLASH_COMMANDS) {
-    return withCanvasCommands(commands).map((c) => ({ name: c.name, description: c.description }));
+ *  vendored builtins. The native canvas commands are always appended (minus the
+ *  remote-unsafe ones when `remote`). Shaped for pi-tui's `CombinedAutocompleteProvider`. */
+export function slashCommandList(commands = BUILTIN_SLASH_COMMANDS, remote = false) {
+    return withCanvasCommands(commands, remote).map((c) => ({ name: c.name, description: c.description }));
 }
 /** Same list as flat autocomplete items (value/label/description). */
-export function commandAutocompleteItems(commands = BUILTIN_SLASH_COMMANDS) {
-    return withCanvasCommands(commands).map((c) => ({ value: `/${c.name}`, label: `/${c.name}`, description: c.description }));
+export function commandAutocompleteItems(commands = BUILTIN_SLASH_COMMANDS, remote = false) {
+    return withCanvasCommands(commands, remote).map((c) => ({ value: `/${c.name}`, label: `/${c.name}`, description: c.description }));
 }
 // ---------------------------------------------------------------------------
 // Canvas commands — native reimplementations of the canvas chrome extensions.
@@ -231,6 +258,14 @@ export function commandAutocompleteItems(commands = BUILTIN_SLASH_COMMANDS) {
 /** Dispatch one of the four native canvas commands. Always returns `true` (the
  *  command is viewer-owned — never forwarded to the engine as a prompt). */
 function dispatchCanvasCommand(name, arg, ctx) {
+    // Structural omission (withCanvasCommands) keeps these out of remote-mode
+    // autocomplete; this gate is the belt-and-suspenders that also makes them
+    // NOT EXECUTABLE if typed by hand — a remote node id has no relationship to
+    // this machine's local canvas.db (or, worse, collides with one that does).
+    if (ctx.remote && REMOTE_UNSAFE_CANVAS_NAMES.has(name)) {
+        ctx.notify(`/${name} is not available for a remote attach (--canvas) — it acts on this machine's local canvas`);
+        return true;
+    }
     switch (name) {
         case 'graph':
             // `/graph` is inherently the in-process GRAPH overlay (canvas-nav.ts

package/dist/clients/attach/transport-relay.d.ts

@@ -2,7 +2,11 @@ import { EventEmitter } from 'node:events';
 import type { ClientToBroker } from '../../core/runtime/broker-protocol.js';
 import { type Transport } from './transport.js';
 /** A resolved remote canvas target — see `remote-canvas-target.ts` for how
- *  this is assembled from config + the token's env var, never from argv. */
+ *  this is assembled from config (`relayTokenRef`) plus the 0600 secrets store
+ *  via `resolveRemoteCanvasTarget`. This transport itself never takes the
+ *  token from argv — `canvas config add --relay-token -` is the only accepted
+ *  form for writing a token to the store — stdin-only, never argv; that is a
+ *  one-time config-write path, not this call. */
 export interface RelayTarget {
     /** The preview endpoint origin, e.g. `https://<hash>.preview.bl.run`. */
     previewEndpoint: string;
@@ -14,12 +18,8 @@ export declare class RelayTransport extends EventEmitter implements Transport {
     private readonly target;
     private ws;
     private closeEmitted;
-    /** One redial fault line per reconnect EPISODE, not per attempt — mirrors
-     *  SocketTransport. */
-    private redialFaultRecorded;
     constructor(nodeId: string, target: RelayTarget);
     private get url();
-    private recordRelayFault;
     private dial;
     connect(): void;
     /** Re-dial the SAME `wss://<previewEndpoint>/node/<id>` — the preview

package/dist/clients/attach/transport-relay.js

@@ -18,7 +18,6 @@
 import { EventEmitter } from 'node:events';
 import { WebSocket } from 'ws';
 import { classify } from '../../core/fault-classifier.js';
-import { clearFault, recordFault } from '../../core/runtime/fault.js';
 import { BrokerUnavailableError } from './transport.js';
 function relayUrl(target, nodeId) {
     const url = new URL(target.previewEndpoint);
@@ -33,9 +32,6 @@ export class RelayTransport extends EventEmitter {
     target;
     ws;
     closeEmitted = false;
-    /** One redial fault line per reconnect EPISODE, not per attempt — mirrors
-     *  SocketTransport. */
-    redialFaultRecorded = false;
     constructor(nodeId, target) {
         super();
         this.nodeId = nodeId;
@@ -44,23 +40,6 @@ export class RelayTransport extends EventEmitter {
     get url() {
         return relayUrl(this.target, this.nodeId);
     }
-    recordRelayFault(op, err) {
-        if (op === 'redial') {
-            if (this.redialFaultRecorded)
-                return;
-            this.redialFaultRecorded = true;
-        }
-        const classified = classify('viewer↔broker', err);
-        recordFault(this.nodeId, {
-            link: 'viewer↔broker',
-            op,
-            kind: classified.kind,
-            retry: op === 'redial'
-                ? { disposition: 'auto', by: 'client' }
-                : { disposition: 'manual' },
-            message: err instanceof Error ? err.message : String(err),
-        });
-    }
     dial() {
         const ws = new WebSocket(this.url, {
             headers: { authorization: `Bearer ${this.target.relayToken}` },
@@ -72,12 +51,10 @@ export class RelayTransport extends EventEmitter {
     connect() {
         const ws = this.dial();
         ws.on('open', () => {
-            this.redialFaultRecorded = false;
-            clearFault(this.nodeId, { link: 'viewer↔broker' });
             this.emit('connect');
         });
         ws.on('message', (data) => this.onMessage(data));
-        ws.on('error', (err) => this.onError(err, 'connect'));
+        ws.on('error', (err) => this.onError(err));
         ws.on('close', (code, reason) => this.onClose(code, reason.toString()));
     }
     /** Re-dial the SAME `wss://<previewEndpoint>/node/<id>` — the preview
@@ -92,19 +69,16 @@ export class RelayTransport extends EventEmitter {
                 if (settled)
                     return;
                 settled = true;
-                this.redialFaultRecorded = false;
-                clearFault(this.nodeId, { link: 'viewer↔broker' });
                 this.emit('connect');
                 resolve();
             });
             ws.on('message', (data) => this.onMessage(data));
             ws.on('error', (err) => {
                 if (settled) {
-                    this.onError(err, 'redial');
+                    this.onError(err);
                     return;
                 }
                 settled = true;
-                this.recordRelayFault('redial', err);
                 try {
                     ws.terminate();
                 }
@@ -154,8 +128,7 @@ export class RelayTransport extends EventEmitter {
         }
         this.emit('frame', frame);
     }
-    onError(err, op) {
-        this.recordRelayFault(op, err);
+    onError(err) {
         this.emitError(new Error(`relay transport error: ${err.message}`));
         // 'close' follows 'error'; teardown converges there.
     }

package/dist/commands/__tests__/canvas-config.test.d.ts

@@ -0,0 +1 @@
+export {};