@crouton-kit/crouter 0.3.70 → 0.3.79

package/dist/core/runtime/broker.js

@@ -22,20 +22,23 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { getAgentDir, initTheme, } from '@earendil-works/pi-coding-agent';
-import { jobDir, nodeDir, viewSocketPath } from '../canvas/paths.js';
+import { jobDir, nodeDir, sessionListCachePath, viewSocketPath } from '../canvas/paths.js';
+import { SessionListCache } from './session-list-cache.js';
 import { getNode, updateNode } from '../canvas/index.js';
 import { FRONT_DOOR_ENV } from './front-door.js';
-import { equivalentOtherProviderModel, normalizeModel, piInvocationToSdkConfig, } from './launch.js';
+import { equivalentOtherProviderModel, nextLadderModel, normalizeModel, piInvocationToSdkConfig, } from './launch.js';
 import { assertEngineVersion, loadBrokerEngine } from './broker-sdk.js';
+import { resolveBundledPiPackageDir } from './pi-cli.js';
 import { classify } from '../fault-classifier.js';
 import { isModelNotFoundError, readFault, recordFault, recordFaultForCurrentNode } from './fault.js';
 import { CONNECTION_FAULT_RECOVERY_BODY, PROVIDER_FAULT_RECOVERY_BODY } from './fault-recovery-nudge.js';
 import { markFatalOnExhaust, nextFaultRetry, policyFor } from './fault-recovery.js';
 import { probeOnline as probeOnlineReal } from './connectivity.js';
 import { CRTR_CYCLE_CUSTOM_TYPE, cycleAwareMessages } from './session-cycles.js';
-import { BUILTIN_SLASH_COMMANDS } from './pi-vendored.js';
+import { BUILTIN_SLASH_COMMANDS, piSessionsRoot } from './pi-vendored.js';
+import { StreamWatchdog, resolveStreamWatchdogMs } from './stream-watchdog.js';
 import { encodeFrame, FrameDecoder, FrameOverflowError, BROKER_READ_CAPS, } from './broker-protocol.js';
-const THINKING_LEVELS = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh']);
+const THINKING_LEVELS = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']);
 function parseModelSpec(spec) {
     const i = spec.lastIndexOf(':');
     if (i <= 0)
@@ -166,7 +169,12 @@ export async function runBroker(nodeId) {
     // before_provider_request handler throwing, so its injected Claude-Code billing
     // header was dropped and subscription turns 400'd ("draws from extra usage").
     // headless ⇒ no file watcher (false). Idempotent global; call once at boot.
+    // Always replace an inherited PI_PACKAGE_DIR: a viewer launched from a pnpm
+    // path may pass its `.pnpm` package copy down to the daemon/broker, but that
+    // copy can omit the JSON theme assets. The broker must use crouter's actual
+    // bundled package root, exactly like its incidental pi subprocesses.
     try {
+        process.env['PI_PACKAGE_DIR'] = resolveBundledPiPackageDir();
         initTheme(services.settingsManager.getTheme(), false);
     }
     catch (err) {
@@ -182,6 +190,14 @@ export async function runBroker(nodeId) {
     const attachPath = join(jobDir(nodeId), 'attach.json');
     const clients = new Set();
     const pendingDialogs = new Map();
+    // Fire-and-forget extension display state must survive a viewer detach. The
+    // extension may paint a widget (notably the inactivity brief) while nobody is
+    // attached; retain the latest keyed state so the next hello can replay it
+    // immediately after welcome instead of making "persistent" mean "only if you
+    // happened to be watching when the frame fired".
+    const displayStatuses = new Map();
+    const displayWidgets = new Map();
+    let displayTitle;
     let controllerId = null;
     let disposed = false;
     let server;
@@ -311,6 +327,26 @@ export async function runBroker(nodeId) {
             if (c.helloed)
                 sendFrame(c, frame);
     };
+    /** Retain and broadcast extension UI frames. Updating a keyed display entry
+     *  moves it to the end, matching pi's insertion-ordered widget behavior;
+     *  non-display UI frames (notify/dialog dismissal) simply pass through. */
+    const broadcastUi = (frame) => {
+        if (frame.type === 'display_status') {
+            displayStatuses.delete(frame.key);
+            if (frame.text !== undefined)
+                displayStatuses.set(frame.key, frame.text);
+        }
+        else if (frame.type === 'display_widget') {
+            displayWidgets.delete(frame.key);
+            if (frame.lines !== undefined) {
+                displayWidgets.set(frame.key, { lines: [...frame.lines], placement: frame.placement });
+            }
+        }
+        else if (frame.type === 'display_title') {
+            displayTitle = frame.title;
+        }
+        broadcast(frame);
+    };
     // ---------------------------------------------------------------------------
     // F2: message_update coalescing. `relayEvent` is the single entry point for
     // engine events headed to viewers: a message_update is held (latest wins) and
@@ -321,6 +357,26 @@ export async function runBroker(nodeId) {
     let pendingUpdate = null;
     let pendingUpdateTimer = null;
     let faultRetryTimer = null;
+    // Dead-provider-stream detector (see stream-watchdog.ts): poked while a turn
+    // is awaiting the provider (NOT while a tool executes — a silent long tool
+    // must not trip it), cleared at agent_end. Fires at most once per stall,
+    // aborting the session so the fault-retry machinery (armed on agent_end)
+    // re-drives the turn instead of the broker wedging until the daemon's
+    // 20-minute hard kick.
+    //
+    // `sessionGeneration` bumps on every rebindSession; each poke stamps its arm
+    // with the current generation and the stall callback ignores a fire whose
+    // stamp is stale — so an old timer that fires while a rebind is in flight
+    // can't abort the NEW session it dereferences.
+    const streamWatchdogMs = resolveStreamWatchdogMs();
+    let sessionGeneration = 0;
+    const executingTools = new Set();
+    const streamWatchdog = new StreamWatchdog((armedGeneration) => {
+        if (armedGeneration !== sessionGeneration)
+            return; // superseded session — stale timer, no-op
+        logBroker(`stream watchdog: no engine event for ${streamWatchdogMs}ms while streaming — aborting stalled provider stream`);
+        void session.abort().catch((err) => logBroker(`stream watchdog abort failed: ${String(err)}`));
+    }, streamWatchdogMs);
     const flushPendingUpdate = () => {
         if (pendingUpdateTimer !== null) {
             clearTimeout(pendingUpdateTimer);
@@ -546,6 +602,31 @@ export async function runBroker(nodeId) {
             clearFaultRetryTimer();
         if (type === 'agent_end' && !session.isStreaming)
             scheduleFaultRetry();
+        // The watchdog covers ONLY time awaiting the provider. `session.isStreaming`
+        // stays true through tool execution, so a legitimately silent tool lasting
+        // longer than the timeout would otherwise be aborted mid-run: disarm while
+        // any tool executes and rearm once the last one ends. Multiple tools can run
+        // concurrently, so track in-flight ids and only rearm when the set drains.
+        if (type === 'agent_end') {
+            // Clear the in-flight set too: an abnormal run can emit agent_end after a
+            // tool_execution_start with no matching tool_execution_end. A leftover id
+            // would keep executingTools non-empty forever, gating every future poke
+            // (size === 0) and permanently disarming the watchdog until a rebind.
+            executingTools.clear();
+            streamWatchdog.clear();
+        }
+        else if (type === 'tool_execution_start') {
+            executingTools.add(event.toolCallId ?? '');
+            streamWatchdog.clear();
+        }
+        else if (type === 'tool_execution_end') {
+            executingTools.delete(event.toolCallId ?? '');
+            if (executingTools.size === 0 && session.isStreaming)
+                streamWatchdog.poke(sessionGeneration);
+        }
+        else if (session.isStreaming && executingTools.size === 0) {
+            streamWatchdog.poke(sessionGeneration);
+        }
         if (type === 'message_update') {
             pendingUpdate = event; // latest full-message update supersedes the held one
             if (pendingUpdateTimer === null) {
@@ -595,7 +676,7 @@ export async function runBroker(nodeId) {
     // footer shows the stale model until the next unrelated event.
     const broadcastModelChanged = () => {
         persistModelChoice();
-        broadcast({ type: 'model_changed', model: session.model?.id });
+        broadcast({ type: 'model_changed', model: session.model?.id, spec: formatModelSpec(session.model, session.thinkingLevel) });
     };
     const buildSnapshot = () => ({
         messages: snapshotMessages(session),
@@ -629,6 +710,17 @@ export async function runBroker(nodeId) {
             pending_dialog: first !== undefined ? first.request : null,
             agentDir: getAgentDir(),
         }, true);
+        // `welcome` tells viewers to reset display chrome; replay the broker's
+        // retained extension state immediately after it so attaching AFTER an idle
+        // brief was generated still shows the brief on first paint.
+        for (const [key, text] of displayStatuses) {
+            sendFrame(client, { type: 'display_status', key, text });
+        }
+        for (const [key, widget] of displayWidgets) {
+            sendFrame(client, { type: 'display_widget', key, lines: widget.lines, placement: widget.placement });
+        }
+        if (displayTitle !== undefined)
+            sendFrame(client, { type: 'display_title', title: displayTitle });
     };
     // T4 re-route on become-controller: a dialog raised while a prior controller was
     // attached stays pending after that controller detaches (it is NOT cancelled —
@@ -655,6 +747,7 @@ export async function runBroker(nodeId) {
             return;
         disposed = true;
         activeSession = null; // graceful path owns dispose; keep the fatal hook a no-op
+        streamWatchdog.clear();
         try {
             session.dispose();
         }
@@ -696,7 +789,7 @@ export async function runBroker(nodeId) {
         controller: controllerClient,
         forward: (client, request) => sendFrame(client, request),
         pending: pendingDialogs,
-        broadcast,
+        broadcast: broadcastUi,
     });
     // -------------------------------------------------------------------------
     // 3+4 (plan): bind the FULL canvas extensions (mode 'print') AND fan the single
@@ -733,6 +826,15 @@ export async function runBroker(nodeId) {
         }
     };
     const rebindSession = async () => {
+        // Disarm + invalidate the old watchdog BEFORE swapping the session reference
+        // or crossing the bindExtensions await: an old timer that fires during that
+        // await would otherwise dereference the mutable `session` (now the NEW one)
+        // and abort the replacement. Bumping the generation makes any surviving
+        // stale arm a no-op (its stamp no longer matches); clearing removes the arm
+        // outright. executingTools is per-session in-flight state — reset it too.
+        streamWatchdog.clear();
+        sessionGeneration += 1;
+        executingTools.clear();
         if (runtime !== undefined) {
             session = runtime.session; // the runtime replaced it; follow the new one
             services = runtime.services;
@@ -760,6 +862,7 @@ export async function runBroker(nodeId) {
             pendingUpdateTimer = null;
         }
         clearFaultRetryTimer();
+        streamWatchdog.clear();
         pendingUpdate = null;
         unsubscribe = session.subscribe((event) => {
             try {
@@ -1093,16 +1196,18 @@ export async function runBroker(nodeId) {
         };
         return { type: 'data', id, kind: 'get_settings', settings };
     };
+    // Cache per-session wire info keyed by (path, mtime, size) so reopening the
+    // picker doesn't re-read the whole corpus (see session-list-cache.ts).
+    const sessionListCache = new SessionListCache(sessionListCachePath());
+    // Pre-warm the cwd scope (the picker's default tab) in the background so the
+    // first /resume open on this fresh broker is already warm.
+    sessionListCache.prewarm(session.sessionManager.getSessionDir());
     const buildSessionsData = async (id, scope) => {
         const sm = session.sessionManager;
-        const raw = scope === 'all'
-            ? await engine.SessionManager.listAll()
-            : await engine.SessionManager.list(sm.getCwd(), sm.getSessionDir());
-        const sessions = raw.map((s) => ({
-            ...s,
-            created: s.created.toISOString(),
-            modified: s.modified.toISOString(),
-        }));
+        const sessionDir = sm.getSessionDir();
+        const sessions = scope === 'all'
+            ? await sessionListCache.listAll(piSessionsRoot())
+            : await sessionListCache.listDir(sessionDir);
         return {
             type: 'data',
             id,
@@ -1264,6 +1369,40 @@ export async function runBroker(nodeId) {
                     .catch(engineErrorTo(client));
                 break;
             }
+            case 'cycle_ladder': {
+                if (notController(client, 'cycle the model ladder'))
+                    break;
+                // Resolve the next interleaved-ladder rung from the current model+thinking
+                // spec, then reuse the set_model path (registry resolve + thinking apply).
+                const currentSpec = formatModelSpec(session.model, session.thinkingLevel) ?? '';
+                const nextSpec = parseModelSpec(nextLadderModel(currentSpec, frame.direction === 'backward' ? -1 : 1));
+                let ladderModel;
+                try {
+                    ladderModel = resolveModelQuery(nextSpec.modelSpec);
+                }
+                catch (err) {
+                    engineErrorTo(client)(err);
+                    break;
+                }
+                if (ladderModel === undefined) {
+                    sendFrame(client, {
+                        type: 'error',
+                        code: 'engine_error',
+                        message: `ladder model '${nextSpec.modelSpec}' not in the registry`,
+                    });
+                    break;
+                }
+                void session
+                    .setModel(ladderModel)
+                    .then(() => {
+                    if (nextSpec.thinkingLevel !== undefined)
+                        session.setThinkingLevel(nextSpec.thinkingLevel);
+                    ackTo(client, 'cycle_ladder');
+                    broadcastModelChanged();
+                })
+                    .catch(engineErrorTo(client));
+                break;
+            }
             case 'cycle_thinking': {
                 if (notController(client, 'cycle the thinking level'))
                     break;
@@ -1920,6 +2059,13 @@ export function makeBrokerUiContext(deps) {
             };
             const onAbort = () => {
                 cleanup();
+                // The extension aborted this request out-of-band (e.g. an OAuth loopback
+                // callback won the race against a still-open manual-paste dialog). Tell
+                // the controller to tear down THIS overlay by id — an unanswered dialog
+                // whose broker entry we just dropped would otherwise linger onscreen with
+                // nothing left to answer it. Keyed to request.id so only the abandoned
+                // dialog is dismissed, never an unrelated one.
+                deps.broadcast({ type: 'extension_ui_dismiss', id: request.id });
                 resolve(defaultValue);
             };
             opts?.signal?.addEventListener('abort', onAbort, { once: true });
@@ -1930,6 +2076,10 @@ export function makeBrokerUiContext(deps) {
             const ms = opts?.timeout !== undefined ? opts.timeout : DEFAULT_DIALOG_TIMEOUT_MS;
             timer = setTimeout(() => {
                 cleanup();
+                // Same correlated teardown as onAbort: the broker resolved this dialog on
+                // its own timeout, so the controller's overlay (which has no independent
+                // timer) must be dismissed by id or it lingers forever.
+                deps.broadcast({ type: 'extension_ui_dismiss', id: request.id });
                 resolve(defaultValue);
             }, ms);
             if (typeof timer.unref === 'function')

package/dist/core/runtime/launch.d.ts

@@ -1,8 +1,7 @@
 import type { NodeMeta, LaunchSpec, Mode, Lifecycle } from '../canvas/index.js';
-import type { ModelProvider, ModelStrength } from '../../types.js';
+import type { ModelProvider, ModelStrength, ScopeConfig } from '../../types.js';
 export declare const CANVAS_STOPHOOK_PATH: string;
 export declare const CANVAS_INBOX_WATCHER_PATH: string;
-export declare const CANVAS_NAV_PATH: string;
 export declare const CANVAS_RECAP_PATH: string;
 export declare const CANVAS_GOAL_CAPTURE_PATH: string;
 export declare const CANVAS_PASSIVE_CONTEXT_PATH: string;
@@ -11,9 +10,9 @@ export declare const CANVAS_DOC_SUBSTRATE_PATH: string;
 export declare const CANVAS_STRUCTURED_OUTPUT_PATH: string;
 export declare const CANVAS_BASH_VALVE_PATH: string;
 /** The canvas extensions every node loads, in order: stophook (routing +
- *  telemetry + session-id capture), inbox-watcher (wake), nav (in-editor
- *  graph chrome), recap (the per-node inactivity recap card — Haiku over the
- *  conversation, shown above the manager line after 300s of no message),
+ *  telemetry + session-id capture), inbox-watcher (wake), recap (the per-node
+ *  inactivity brief — a headless summary of the conversation, shown faintly
+ *  above the editor border after 60s of no message),
  *  goal-capture (persist the first user message as the goal),
  *  passive-context (drain passive backlog as pre-text on the next message),
  *  context-intro (inject the <crtr-bearings> block + the <memory kind="knowledge">
@@ -43,7 +42,29 @@ export interface EquivalentProviderModel {
  *  is per-turn state: once a provider has produced a retryable outage error, do
  *  not bounce back to it or keep reattempting the same failed provider. */
 export declare function equivalentOtherProviderModel(currentModel: string, failedProviders?: ReadonlySet<ModelProvider>): EquivalentProviderModel | null;
-export declare function normalizeModel(model: string): string;
+/** True when `model` is a PORTABLE ladder token — a bare strength/alias
+ *  (`ultra`, `normal`, `opus`, …) or a `anthropic|openai / strength` pair —
+ *  i.e. a form `normalizeModel` resolves through the ladders rather than
+ *  passing through as a concrete id. Portable tokens are safe to PERSIST as
+ *  defaults (`persistDefaultKindModel`): they re-resolve against whatever
+ *  ladder the running build ships, so they never freeze a stale concrete
+ *  model id to disk. Mirrors `normalizeModel`'s branch structure exactly. */
+export declare function isPortableModelToken(model: string): boolean;
+export declare function normalizeModel(model: string, ladders?: ScopeConfig['modelLadders']): string;
+/** The interleaved model-ladder cycle Alt+M / Alt+Shift+M walks: for each strength tier
+ *  from strongest to weakest, BOTH providers before descending — anthropic/ultra,
+ *  openai/ultra, anthropic/strong, openai/strong, anthropic/medium, … Returns the
+ *  concrete `provider/id:thinking` ladder cells in that order. */
+export declare function interleavedLadderCycle(): string[];
+/** The next model in the interleaved ladder cycle, starting from `currentSpec`
+ *  (a `provider/id:thinking` spec — pass `formatModelSpec(session.model,
+ *  session.thinkingLevel)`). `direction` is +1 (forward) or -1 (backward).
+ *
+ *  Rungs are matched on bare id AND thinking level first, so ladder cells that
+ *  share a bare model id (e.g. anthropic ultra=…:high vs strong=…:medium) don't
+ *  collapse onto each other; a bare-id-only match is the fallback. An off-ladder
+ *  current model starts the cycle at its top (the strongest anthropic rung). */
+export declare function nextLadderModel(currentSpec: string, direction?: 1 | -1): string;
 /** The minimal static system prompt every node launches with — a thin launcher
  *  frame keeping the `\n\nGuidelines:` anchor the `before_agent_start` substrate
  *  hook (canvas-doc-substrate.ts) splices its `<memory kind="preference">` block
@@ -74,6 +95,18 @@ export declare function buildLaunchSpec(kind: string, mode: Mode, opts: {
     hasManager: boolean;
     extraEnv?: Record<string, string>;
     model?: string;
+    /** The TARGET node's cwd — anchors the project-scope stack for kind/ladder
+     *  resolution. Defaults to this process's own cwd, which is correct only
+     *  when the caller IS resolving for itself; spawn/polymorph paths must
+     *  pass the node's own cwd (same rule as `readMergedLaunchConfig`). */
+    cwd?: string;
+    /** The TARGET node's profile id — REQUIRED for a profile's kind/ladder
+     *  overrides (e.g. a `/model` default persisted by
+     *  `persistDefaultKindModel`) to be honored. Defaults to the ambient
+     *  `CRTR_PROFILE_ID`, which is EMPTY for a front-door shell invocation —
+     *  exactly the path that creates the user's sessions — so callers that
+     *  know the node's profile must pass it explicitly (null = no profile). */
+    profileId?: string | null;
 }): {
     launch: LaunchSpec;
     lifecycle: 'terminal' | 'resident';

package/dist/core/runtime/launch.js

@@ -11,7 +11,7 @@
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { readMergedLaunchConfig, resolveKindConfig } from '../config.js';
+import { readMergedLaunchConfig } from '../config.js';
 import { nodeEnv } from './nodes.js';
 import { editorLabel } from '../canvas/index.js';
 import { nodeDir } from '../canvas/paths.js';
@@ -29,7 +29,6 @@ function resolveExtension(name) {
 }
 export const CANVAS_STOPHOOK_PATH = resolveExtension('canvas-stophook');
 export const CANVAS_INBOX_WATCHER_PATH = resolveExtension('canvas-inbox-watcher');
-export const CANVAS_NAV_PATH = resolveExtension('canvas-nav');
 export const CANVAS_RECAP_PATH = resolveExtension('canvas-recap');
 export const CANVAS_GOAL_CAPTURE_PATH = resolveExtension('canvas-goal-capture');
 export const CANVAS_PASSIVE_CONTEXT_PATH = resolveExtension('canvas-passive-context');
@@ -38,9 +37,9 @@ export const CANVAS_DOC_SUBSTRATE_PATH = resolveExtension('canvas-doc-substrate'
 export const CANVAS_STRUCTURED_OUTPUT_PATH = resolveExtension('canvas-structured-output');
 export const CANVAS_BASH_VALVE_PATH = resolveExtension('canvas-bash-valve');
 /** The canvas extensions every node loads, in order: stophook (routing +
- *  telemetry + session-id capture), inbox-watcher (wake), nav (in-editor
- *  graph chrome), recap (the per-node inactivity recap card — Haiku over the
- *  conversation, shown above the manager line after 300s of no message),
+ *  telemetry + session-id capture), inbox-watcher (wake), recap (the per-node
+ *  inactivity brief — a headless summary of the conversation, shown faintly
+ *  above the editor border after 60s of no message),
  *  goal-capture (persist the first user message as the goal),
  *  passive-context (drain passive backlog as pre-text on the next message),
  *  context-intro (inject the <crtr-bearings> block + the <memory kind="knowledge">
@@ -56,7 +55,6 @@ export const CANVAS_BASH_VALVE_PATH = resolveExtension('canvas-bash-valve');
 export const CANVAS_EXTENSIONS = [
     CANVAS_STOPHOOK_PATH,
     CANVAS_INBOX_WATCHER_PATH,
-    CANVAS_NAV_PATH,
     CANVAS_RECAP_PATH,
     CANVAS_GOAL_CAPTURE_PATH,
     CANVAS_PASSIVE_CONTEXT_PATH,
@@ -93,8 +91,8 @@ function ladderFor(provider, ladders = modelLadders()) {
  *  on the OpenAI ladder; anything else defaults to Anthropic. A configured
  *  defaultProvider in config.json wins over this env. */
 export const OPENAI_PROVIDER_ENV = 'CRTR_MODEL_PROVIDER';
-function defaultProvider() {
-    const cfgProvider = readMergedLaunchConfig().modelLadders.defaultProvider;
+function defaultProvider(ladders = modelLadders()) {
+    const cfgProvider = ladders.defaultProvider;
     if (cfgProvider === 'anthropic' || cfgProvider === 'openai')
         return cfgProvider;
     return (process.env[OPENAI_PROVIDER_ENV] ?? '').toLowerCase() === 'openai' ? 'openai' : 'anthropic';
@@ -163,12 +161,11 @@ function modelTokenStrength(model) {
         return 'light';
     return null;
 }
-function resolvedModelStrength(model) {
+function resolvedModelStrength(model, ladders = modelLadders()) {
     const tokenStrength = modelTokenStrength(model);
     if (tokenStrength !== null)
         return tokenStrength;
-    const ladders = modelLadders();
-    const comparable = stripThinkingSuffix(normalizeModel(model));
+    const comparable = stripThinkingSuffix(normalizeModel(model, ladders));
     for (const provider of MODEL_PROVIDER_KEYS) {
         for (const strength of MODEL_STRENGTHS) {
             if (stripThinkingSuffix(ladders[provider][strength]) === comparable)
@@ -180,21 +177,36 @@ function resolvedModelStrength(model) {
 function isReviewQualityKind(kind) {
     return kind === 'review' || kind.startsWith('plan/reviewers/');
 }
-function floorReviewModel(kind, requestedModel, kindModel) {
+function floorReviewModel(kind, requestedModel, kindModel, ladders = modelLadders()) {
     if (requestedModel === undefined)
         return kindModel;
     if (!isReviewQualityKind(kind) || kindModel === undefined)
         return requestedModel;
-    const requestedStrength = resolvedModelStrength(requestedModel);
-    const floorStrength = resolvedModelStrength(kindModel);
+    const requestedStrength = resolvedModelStrength(requestedModel, ladders);
+    const floorStrength = resolvedModelStrength(kindModel, ladders);
     if (requestedStrength === null || floorStrength === null)
         return requestedModel;
     return MODEL_STRENGTH_RANK[requestedStrength] < MODEL_STRENGTH_RANK[floorStrength]
         ? kindModel
         : requestedModel;
 }
-export function normalizeModel(model) {
-    const ladders = modelLadders();
+/** True when `model` is a PORTABLE ladder token — a bare strength/alias
+ *  (`ultra`, `normal`, `opus`, …) or a `anthropic|openai / strength` pair —
+ *  i.e. a form `normalizeModel` resolves through the ladders rather than
+ *  passing through as a concrete id. Portable tokens are safe to PERSIST as
+ *  defaults (`persistDefaultKindModel`): they re-resolve against whatever
+ *  ladder the running build ships, so they never freeze a stale concrete
+ *  model id to disk. Mirrors `normalizeModel`'s branch structure exactly. */
+export function isPortableModelToken(model) {
+    if (model.includes('/')) {
+        const slash = model.indexOf('/');
+        const provider = model.slice(0, slash);
+        const rest = model.slice(slash + 1);
+        return (provider === 'anthropic' || provider === 'openai') && STRENGTH_ALIASES[rest] !== undefined;
+    }
+    return STRENGTH_ALIASES[model] !== undefined || model === 'opus' || model === 'sonnet' || model === 'haiku';
+}
+export function normalizeModel(model, ladders = modelLadders()) {
     // 1. Qualified provider/rest.
     if (model.includes('/')) {
         const slash = model.indexOf('/');
@@ -210,7 +222,7 @@ export function normalizeModel(model) {
     // 2. Bare strength → default-provider ladder.
     const strength = STRENGTH_ALIASES[model];
     if (strength !== undefined)
-        return ladderFor(defaultProvider(), ladders)[strength];
+        return ladderFor(defaultProvider(ladders), ladders)[strength];
     // 3. Bare family alias → always Anthropic.
     if (model === 'opus')
         return ladders.anthropic.strong;
@@ -221,6 +233,50 @@ export function normalizeModel(model) {
     // 4. Unknown — pass through.
     return model;
 }
+/** The thinking suffix of a ladder cell / model spec (`…:high` → `high`), or
+ *  undefined when the trailing `:token` is a model-id segment rather than a
+ *  known thinking level. */
+function thinkingSuffixOf(spec) {
+    const i = spec.lastIndexOf(':');
+    if (i <= 0)
+        return undefined;
+    const suffix = spec.slice(i + 1);
+    return THINKING_SUFFIXES.has(suffix) ? suffix : undefined;
+}
+/** The interleaved model-ladder cycle Alt+M / Alt+Shift+M walks: for each strength tier
+ *  from strongest to weakest, BOTH providers before descending — anthropic/ultra,
+ *  openai/ultra, anthropic/strong, openai/strong, anthropic/medium, … Returns the
+ *  concrete `provider/id:thinking` ladder cells in that order. */
+export function interleavedLadderCycle() {
+    const ladders = modelLadders();
+    const order = [];
+    for (const strength of MODEL_STRENGTHS) {
+        for (const provider of MODEL_PROVIDER_KEYS) {
+            order.push(ladders[provider][strength]);
+        }
+    }
+    return order;
+}
+/** The next model in the interleaved ladder cycle, starting from `currentSpec`
+ *  (a `provider/id:thinking` spec — pass `formatModelSpec(session.model,
+ *  session.thinkingLevel)`). `direction` is +1 (forward) or -1 (backward).
+ *
+ *  Rungs are matched on bare id AND thinking level first, so ladder cells that
+ *  share a bare model id (e.g. anthropic ultra=…:high vs strong=…:medium) don't
+ *  collapse onto each other; a bare-id-only match is the fallback. An off-ladder
+ *  current model starts the cycle at its top (the strongest anthropic rung). */
+export function nextLadderModel(currentSpec, direction = 1) {
+    const order = interleavedLadderCycle();
+    const normalized = normalizeModel(currentSpec);
+    const currentBare = stripThinkingSuffix(normalized);
+    const currentThinking = thinkingSuffixOf(normalized);
+    let idx = order.findIndex((ref) => stripThinkingSuffix(ref) === currentBare && thinkingSuffixOf(ref) === currentThinking);
+    if (idx === -1)
+        idx = order.findIndex((ref) => stripThinkingSuffix(ref) === currentBare);
+    if (idx === -1)
+        return order[0];
+    return order[(idx + direction + order.length) % order.length];
+}
 // ---------------------------------------------------------------------------
 // Build the launch spec from {kind, mode}
 // ---------------------------------------------------------------------------
@@ -251,11 +307,13 @@ export const LAUNCH_SYSTEM_PROMPT = 'You are a node in the crtr canvas — an ag
  *  as-given — it is no longer persona-frontmatter-derived. The two canvas
  *  extensions are always first; kind-declared extensions follow. */
 export function buildLaunchSpec(kind, mode, opts) {
-    const kindConfig = resolveKindConfig(kind);
+    const merged = readMergedLaunchConfig(opts.cwd ?? process.cwd(), opts.profileId !== undefined ? opts.profileId : (process.env['CRTR_PROFILE_ID'] || null));
+    const kindConfig = merged.kinds[kind];
+    const ladders = merged.modelLadders;
     const kindModel = mode === 'orchestrator' ? kindConfig?.orchestratorModel ?? kindConfig?.model : kindConfig?.model;
-    const chosenModel = floorReviewModel(kind, opts.model, kindModel);
+    const chosenModel = floorReviewModel(kind, opts.model, kindModel, ladders);
     const launch = {
-        model: chosenModel !== undefined ? normalizeModel(chosenModel) : undefined,
+        model: chosenModel !== undefined ? normalizeModel(chosenModel, ladders) : undefined,
         tools: kindConfig?.tools ?? [],
         extensions: [...CANVAS_EXTENSIONS, ...(kindConfig?.extensions ?? [])],
         systemPrompt: LAUNCH_SYSTEM_PROMPT,

package/dist/core/runtime/naming.js

@@ -17,7 +17,7 @@
 // prompt, so a node always gets a sane name.
 import { execFile } from 'node:child_process';
 import { getNode, updateNode } from '../canvas/index.js';
-import { resolveBundledPiCliPath } from './pi-cli.js';
+import { bundledPiSubprocessEnv, resolveBundledPiCliPath } from './pi-cli.js';
 /** Cap on prompt text fed to the namer — a name needs only the gist. */
 const PROMPT_CAP = 2000;
 /** Wall-clock budget for the headless pi call before we fall back to a slug. */
@@ -107,7 +107,7 @@ function nameArgs(prompt) {
 function headlessName(body) {
     return new Promise((resolve) => {
         try {
-            const child = execFile(process.execPath, [resolveBundledPiCliPath(), ...nameArgs(body)], { encoding: 'utf8', timeout: NAME_TIMEOUT_MS }, (err, stdout) => {
+            const child = execFile(process.execPath, [resolveBundledPiCliPath(), ...nameArgs(body)], { encoding: 'utf8', timeout: NAME_TIMEOUT_MS, env: bundledPiSubprocessEnv() }, (err, stdout) => {
                 if (err || typeof stdout !== 'string')
                     return resolve('');
                 resolve(sanitizeSessionName(stdout));
@@ -188,7 +188,7 @@ export function generateIssueTitle(note) {
         return Promise.resolve('untitled');
     return new Promise((resolve) => {
         try {
-            const child = execFile(process.execPath, [resolveBundledPiCliPath(), ...piTextArgs(TITLE_SYSTEM_PROMPT, titleUserPrompt(body))], { encoding: 'utf8', timeout: NAME_TIMEOUT_MS }, (err, stdout) => {
+            const child = execFile(process.execPath, [resolveBundledPiCliPath(), ...piTextArgs(TITLE_SYSTEM_PROMPT, titleUserPrompt(body))], { encoding: 'utf8', timeout: NAME_TIMEOUT_MS, env: bundledPiSubprocessEnv() }, (err, stdout) => {
                 if (err || typeof stdout !== 'string')
                     return resolve(firstLineTitle(body));
                 const t = stdout.trim().split('\n').map((l) => l.trim()).find((l) => l !== '') ?? '';

package/dist/core/runtime/pi-cli.d.ts

@@ -1,2 +1,8 @@
+export declare function resolveBundledPiPackageDir(): string;
+/** Environment for a bundled pi subprocess. pi resolves theme assets relative
+ *  to its package root; pnpm/npm mixed layouts can make its own module URL point
+ *  through `.pnpm` at a package copy without those JSON assets, so explicitly
+ *  pin the real bundled package directory (the same contract attach uses). */
+export declare function bundledPiSubprocessEnv(): NodeJS.ProcessEnv;
 export declare function resolveBundledPiCliPath(): string;
 export declare function bundledPiCommandForShell(quote: (value: string) => string): string;

package/dist/core/runtime/pi-cli.js

@@ -21,7 +21,7 @@ function findPackageRootFromEntry(entryPath, expectedName) {
         dir = dirname(dir);
     }
 }
-export function resolveBundledPiCliPath() {
+export function resolveBundledPiPackageDir() {
     const packageName = '@earendil-works/pi-coding-agent';
     let entryPath;
     try {
@@ -34,11 +34,25 @@ export function resolveBundledPiCliPath() {
     if (packageRoot === null) {
         throw new Error(`could not locate bundled ${packageName} package root from ${entryPath}`);
     }
+    return packageRoot;
+}
+/** Environment for a bundled pi subprocess. pi resolves theme assets relative
+ *  to its package root; pnpm/npm mixed layouts can make its own module URL point
+ *  through `.pnpm` at a package copy without those JSON assets, so explicitly
+ *  pin the real bundled package directory (the same contract attach uses). */
+export function bundledPiSubprocessEnv() {
+    return {
+        ...process.env,
+        PI_PACKAGE_DIR: resolveBundledPiPackageDir(),
+    };
+}
+export function resolveBundledPiCliPath() {
+    const packageRoot = resolveBundledPiPackageDir();
     const pkgPath = join(packageRoot, 'package.json');
     const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
     const bin = pkg.bin && typeof pkg.bin === 'object' ? pkg.bin.pi : undefined;
     if (typeof bin !== 'string' || bin.trim() === '') {
-        throw new Error(`bundled ${packageName} does not declare a pi binary in ${pkgPath}`);
+        throw new Error(`bundled @earendil-works/pi-coding-agent does not declare a pi binary in ${pkgPath}`);
     }
     const cliPath = join(packageRoot, bin);
     if (!existsSync(cliPath)) {

package/dist/core/runtime/pi-vendored.d.ts

@@ -1,3 +1,11 @@
+/** pi's sessions root, VENDORED from pi `config.getSessionsDir()` (= `<agentDir>/
+ *  sessions`). pi's package `exports` map is `.`-only, so config.js can't be
+ *  deep-imported, and a ROOT import of `getAgentDir` would eager-load the entire
+ *  heavy pi SDK index on crtr's front-door hot path (the reason broker-sdk.ts
+ *  dynamic-imports the engine). Mirrors pi: `PI_CODING_AGENT_DIR` env, else
+ *  `~/.pi/agent` (APP_NAME defaults to 'pi'). Re-sync on a pi SDK bump that moves
+ *  the sessions dir — same vendoring rationale as the slash-command list below. */
+export declare function piSessionsRoot(): string;
 /**
  * pi's builtin slash commands — vendored verbatim from pi `core/slash-commands.js`
  * `BUILTIN_SLASH_COMMANDS` (review C1). **21 entries at 0.78.1** (review n1 — NOT 23).