@crouton-kit/crouter 0.3.70 → 0.3.79

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.ts

@@ -20,8 +20,11 @@ import {
   ANTHROPIC_PROVIDER_ID,
   OPENAI_CODEX_PROVIDER_ID,
   formatStatusLine,
+  getLadderProviderId,
   getProviderLabel,
   isManagedProvider,
+  addSubscription,
+  commitDefaultIdentity,
   markSubscriptionAttempt,
   markSubscriptionRateLimited,
   markSubscriptionSuccess,
@@ -29,15 +32,16 @@ import {
   promoteSubscription,
   readRotationConfig,
   readSubscriptionPool,
-  removeSubscription,
+  removeManagedAccount,
   resolveFallbackTarget,
   restorePreferredModelIfPossible,
   switchToFallbackIfPossible,
   upsertSubscription,
+  upsertSubscriptionWithUniqueAccount,
   type FallbackTarget,
   type ManagedProviderId,
   type SubscriptionCredential,
-} from "../lib/subscription-state.js";
+} from "../../../core/subscription-state.js";
 
 const DEFAULT_RATE_LIMIT_BACKOFF_MS = 5 * 60 * 1000;
 const INVALID_REFRESH_TOKEN_BACKOFF_MS = 30 * 24 * 60 * 60 * 1000;
@@ -206,7 +210,21 @@ function retryAfterMs(headers: Record<string, string>): number | undefined {
 }
 
 type RefreshedCredential = { refresh: string; access: string; expires: number };
-type LoginCredential = { refresh: string; access: string; expires: number };
+// Codex login carries the ChatGPT `accountId` (JWT `chatgpt_account_id`); Anthropic login does
+// not (its OAuth token has no account claim). Optional so both providers and the test seam fit.
+type LoginCredential = { refresh: string; access: string; expires: number; accountId?: string };
+
+// Codex login returns the account identity; extract it as a trimmed string (login results type
+// it loosely through the OAuthCredentials index signature). Absent for Anthropic.
+function loginAccountId(cred: { accountId?: unknown }): string | undefined {
+  return typeof cred.accountId === "string" && cred.accountId.trim() ? cred.accountId.trim() : undefined;
+}
+
+// Short, display-only rendering of a Codex account id for `/provider-sub list`, so distinct
+// accounts are observable without dumping the full opaque id.
+function shortAccountId(accountId: string): string {
+  return accountId.length > 12 ? `${accountId.slice(0, 8)}\u2026${accountId.slice(-4)}` : accountId;
+}
 
 // The default slot's live value only ever exists inside auth.json (see
 // `refreshDefaultSlotCredential`) -- once a credential has been through refresh/reauth for
@@ -238,7 +256,7 @@ function openBrowser(url: string): void {
   try {
     const child = spawn(cmd, args, { stdio: "ignore", detached: true });
     child.on("error", () => {
-      /* the notification still contains the URL */
+      /* best effort -- the manual-code dialog's title carries the URL too */
     });
     child.unref();
   } catch {
@@ -282,15 +300,6 @@ async function refreshDefaultSlotCredential(providerId: ManagedProviderId, crede
   return { ...credential, access };
 }
 
-async function persistDefaultSlotCredential(providerId: ManagedProviderId, credential: RefreshedCredential): Promise<void> {
-  const backend = new FileAuthStorageBackend();
-  await backend.withLockAsync(async (current) => {
-    const data: AuthFileData = current ? JSON.parse(current) : {};
-    data[providerId] = { type: "oauth", ...credential };
-    return { result: undefined, next: `${JSON.stringify(data, null, 2)}\n` };
-  });
-}
-
 async function refreshCredentialIfNeeded(providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential> {
   if (credential.label === providerId) return refreshDefaultSlotCredential(providerId, credential);
   if (!credential.refresh || !credential.access || credential.expires === undefined) {
@@ -325,23 +334,34 @@ async function reauthenticateCredential(providerId: ManagedProviderId, credentia
   ctx.ui.notify(`${getProviderLabel(providerId)} subscription "${credential.label}" needs re-authentication. Opening OAuth login...`, "warn");
   const authenticated = await activeLoginForProvider(providerId, ctx);
   if (credential.label === providerId) {
-    // Same single owner as the refresh path: persist the reauthenticated value to
-    // auth.json through the same locked FileAuthStorageBackend seam the refresh path uses.
-    await persistDefaultSlotCredential(providerId, authenticated);
-    const pool = markSubscriptionSuccess(providerId, credential.label, Date.now());
-    const meta = pool.find((entry) => entry.label === credential.label) ?? credential;
+    // Atomically commit the default (re)login: validate account-uniqueness (excluding the
+    // default slot), THEN persist auth.json, THEN causally reconcile the metadata-only pool entry
+    // under the pool lock (pool -> auth order), so a collision rejects BEFORE auth.json switches
+    // and a newer same-account 429 survives. Re-read the healed pool for returned metadata.
+    commitDefaultIdentity(providerId, {
+      refresh: authenticated.refresh,
+      access: authenticated.access,
+      expires: authenticated.expires,
+      accountId: loginAccountId(authenticated),
+      lastRateLimitedAt: credential.lastRateLimitedAt,
+    });
+    const meta = readSubscriptionPool(providerId).find((entry) => entry.label === credential.label) ?? credential;
     return { ...meta, access: authenticated.access };
   }
+  const reauthedAccountId = loginAccountId(authenticated) ?? credential.accountId;
   const next: SubscriptionCredential = {
     ...credential,
     refresh: authenticated.refresh,
     access: authenticated.access,
     expires: authenticated.expires,
+    ...(reauthedAccountId ? { accountId: reauthedAccountId } : {}),
     rateLimitedUntil: 0,
     lastAttemptAt: Date.now(),
     lastRateLimitedAt: credential.lastRateLimitedAt,
   };
-  return (upsertSubscription(providerId, next).find((entry) => entry.label === next.label) ?? next) as ResolvedCredential;
+  // Identity-checked upsert: reauthenticating this explicit slot into an account already held by
+  // ANOTHER slot throws DuplicateSubscriptionError rather than creating a duplicate quota entry.
+  return (upsertSubscriptionWithUniqueAccount(providerId, next).find((entry) => entry.label === next.label) ?? next) as ResolvedCredential;
 }
 
 function defaultStreamForProvider(model: Model<any>, context: Context, options: SimpleStreamOptions | undefined): AssistantMessageEventStream {
@@ -363,6 +383,12 @@ export function __setStreamForProviderForTest(fn: typeof defaultStreamForProvide
   activeStreamForProvider = fn ?? defaultStreamForProvider;
 }
 
+/** Test-only seam: exercise `fallbackRejectionHint` for one rejection discriminant
+ *  (with an optional resolved-but-rejected candidate) without staging a full turn. */
+export function __fallbackRejectionHintForTest(reason: FallbackRejectionReason, candidate?: FallbackTarget): string {
+  return fallbackRejectionHint({ reason, candidate });
+}
+
 // Drives ONE credential, retrying transient (non-rate-limit) failures in place on the
 // SAME credential per #122, and reports back a classified result for #124's logging.
 // A genuine rate limit ends the attempt immediately (the caller cools the credential down
@@ -495,22 +521,70 @@ function emitTerminalError(stream: AssistantMessageEventStream, model: Model<any
   stream.end();
 }
 
+// Why a candidate fallback was rejected -- each reason gets its OWN accurate hint
+// (`fallbackRejectionHint`) so the terminal error never gives advice that can't fix the
+// actual blocker. Only `no_credentials` is a genuine "go authenticate" case; the others
+// are config/exhaustion states where telling the user to authenticate would be misleading.
+type FallbackRejectionReason = "no_ladder_entry" | "already_attempted" | "no_credentials" | "model_unregistered";
+
+// On rejection we carry the resolved-but-rejected `candidate` FallbackTarget whenever one
+// exists (every reason except `no_ladder_entry`, where no target resolved at all), so the
+// hint can name the exact provider/model and build an executable repair command from the
+// candidate's config ladder key + strength.
+type FallbackResolution =
+  | { target: FallbackTarget }
+  | { target?: undefined; reason: FallbackRejectionReason; candidate?: FallbackTarget };
+
 // #123: gates cross-provider fallback on the target actually being usable right now --
 // authenticated (its subscription pool has at least one credential, even if currently
 // cooling down) AND registered in the model registry -- rather than blindly switching the
-// session model to a provider nobody logged into. Returns undefined when there is nothing
-// viable to switch to (config has no ladder rung, the target was already tried this turn,
-// the target has zero credentials, or its resolved model isn't in the registry).
+// session model to a provider nobody logged into. Returns the rejection reason (config has
+// no ladder rung, the target was already tried this turn, the target has zero credentials,
+// or its resolved model isn't in the registry) rather than just `undefined`, so callers can
+// surface an accurate terminal error instead of always defaulting to "authenticate a
+// fallback provider" -- which is actively wrong when the real blocker is a stale ladder.
 function resolveViableFallback(
   providerId: ManagedProviderId,
   modelId: string | undefined,
   attempted: Set<ManagedProviderId>,
-): FallbackTarget | undefined {
+): FallbackResolution {
   const target = resolveFallbackTarget(providerId, modelId, readRotationConfig(), extensionAPI?.getThinkingLevel?.());
-  if (!target || attempted.has(target.providerId)) return undefined;
-  if (readSubscriptionPool(target.providerId).length === 0) return undefined;
-  if (!runtimeContext?.modelRegistry.find(target.providerId, target.modelId)) return undefined;
-  return target;
+  if (!target) return { reason: "no_ladder_entry" };
+  if (attempted.has(target.providerId)) return { reason: "already_attempted", candidate: target };
+  if (readSubscriptionPool(target.providerId).length === 0) return { reason: "no_credentials", candidate: target };
+  if (!runtimeContext?.modelRegistry.find(target.providerId, target.modelId)) {
+    return { reason: "model_unregistered", candidate: target };
+  }
+  return { target };
+}
+
+// Actionable hint appended to a terminal error when no fallback was viable. Each rejection
+// reason gets advice that can actually resolve IT -- only `no_credentials` says
+// "authenticate", since that's the sole case where a login is the missing piece. Telling a
+// user to authenticate when both providers are already exhausted, or when the ladder points
+// at an unregistered model, is actively wrong and was the original bug.
+function fallbackRejectionHint(resolution: FallbackResolution): string {
+  if (resolution.target) return "try again later";
+  const candidate = resolution.candidate;
+  switch (resolution.reason) {
+    case "no_credentials": {
+      const who = candidate ? ` (${getProviderLabel(candidate.providerId)}, e.g. /provider-sub ${candidate.providerId} add)` : " with /provider-sub";
+      return `authenticate a fallback provider${who}, or try again later`;
+    }
+    case "model_unregistered": {
+      // Repair command must be EXECUTABLE as printed: `--value`, and the CONFIG ladder
+      // provider key (`openai`, not the runtime `openai-codex`) plus the candidate's own
+      // strength -- so the user pastes it, swaps in an installed model id, and it works.
+      const ladderKey = candidate ? getLadderProviderId(candidate.providerId) : "<provider>";
+      const strength = candidate?.strength ?? "<strength>";
+      const named = candidate ? candidate.label : "the configured fallback";
+      return `configured fallback ${named} is not in this build's model registry -- the modelLadders config is out of sync with the installed model catalog. Point it at an installed model with \`crtr sys config set modelLadders.${ladderKey}.${strength} --value <installed-model-id>\`, or upgrade/downgrade to a build whose ladder matches`;
+    }
+    case "already_attempted":
+      return "every managed provider was already tried this turn and is exhausted or cooling down -- try again later";
+    case "no_ladder_entry":
+      return "no cross-provider fallback is configured for this model -- set one with `crtr sys config set modelLadders.<provider>.<strength> --value <model-id>`, or try again later";
+  }
 }
 
 // Switches the session model to an already-viability-checked fallback target. On the rare
@@ -648,8 +722,8 @@ async function runManagedProvider(
   const originalModel = getCurrentModelRef(model);
   if (!originalModel) throw new Error(`Provider fallback unavailable: missing current model`);
 
-  const viableTarget = resolveViableFallback(originalModel.providerId, originalModel.modelId, attempted);
-  if (viableTarget) {
+  const fallbackResolution = resolveViableFallback(originalModel.providerId, originalModel.modelId, attempted);
+  if (fallbackResolution.target) {
     const target = await switchToFallbackModel(stream, model, originalModel);
     if (!target) return; // terminal error already emitted
     logRotation(`${getProviderLabel(providerId)} pool exhausted -> ${target.label}`);
@@ -691,12 +765,14 @@ async function runManagedProvider(
     return;
   }
 
+  const fallbackHint = fallbackRejectionHint(fallbackResolution);
+
   emitTerminalError(
     stream,
     model,
     waitMs > SOLE_PROVIDER_MAX_WAIT_MS
-      ? `${label} cooling down for ${Math.ceil(waitMs / 1000)}s — too long to wait automatically; authenticate a fallback provider with /provider-sub, or try again later (tried ${triedList})`
-      : `All managed provider pools exhausted (tried ${triedList})`,
+      ? `${label} cooling down for ${Math.ceil(waitMs / 1000)}s — too long to wait automatically; ${fallbackHint} (tried ${triedList})`
+      : `All managed provider pools exhausted; ${fallbackHint} (tried ${triedList})`,
   );
 }
 
@@ -742,46 +818,117 @@ function updateRotationStatus(ctx: ExtensionContext): void {
 // confirm/select default.
 const OAUTH_MANUAL_INPUT_TIMEOUT_MS = 600_000;
 
+/**
+ * pi-ai races the manual-code-paste dialog against its own loopback callback
+ * server (local attach: the SAME browser can hit both). If the loopback wins,
+ * pi-ai abandons the manual-input promise without ever awaiting it again -- so
+ * left alone it stays open, on the broker AND onscreen, until
+ * OAUTH_MANUAL_INPUT_TIMEOUT_MS elapses (review mrf5doek: local-attach
+ * regression). `run` receives two things:
+ *  - `readCode`, a `ctx.ui.input` wrapper it uses for the manual-code prompt. It
+ *    threads an AbortSignal into the dialog: aborting it makes the broker drop
+ *    the abandoned pending entry AND emit an `extension_ui_dismiss` frame keyed
+ *    to THIS request's id, so the attach viewer tears down exactly this overlay
+ *    (input-controller.ts `dismissDialog`) and nothing else.
+ *  - `dismissManual`, which aborts that signal on demand. `run` fires it at the
+ *    race-winner boundary -- pi-ai's `onProgress` "exchanging..." step, which
+ *    runs the instant it HAS a code and BEFORE the token exchange completes.
+ *    That dismisses the losing overlay promptly instead of after the (for
+ *    OpenAI, unbounded/timeout-less) token exchange returns (review
+ *    mrf68z4h). `onProgress` only ever fires post-code in pi-ai's browser login
+ *    (anthropic.js exchange step; OpenAI's browser path emits none, so its
+ *    dismissal falls back to `finally` below), so firing it never dismisses a
+ *    dialog the user still needs -- a remote paste has already resolved
+ *    `readCode` by then, making the abort a no-op.
+ * `finally` re-aborts unconditionally as the backstop for any path that reported
+ * no progress; AbortController.abort() is idempotent, so a second call is inert.
+ *
+ * `undefined` from `readCode` can ONLY mean the human cancelled or the dialog's
+ * own timeout fired (or our own late abort, which pi-ai's abandoned-promise
+ * `.catch` swallows as inert). pi-ai treats a falsy manual result as "no code
+ * yet" and falls through to its `onPrompt` paste-only fallback -- a second,
+ * URL-less dialog with the ordinary 120s default timeout, breaking the
+ * one-dialog contract and making Cancel look inert (review mrf5doek finding
+ * 2). `readCode` throws instead, ending the OAuth attempt directly.
+ */
+export async function loginWithManualInputCleanup<T>(
+  ctx: ExtensionContext,
+  run: (
+    readCode: (title: string, placeholder: string) => Promise<string>,
+    dismissManual: () => void,
+  ) => Promise<T>,
+): Promise<T> {
+  const controller = new AbortController();
+  const readCode = async (title: string, placeholder: string): Promise<string> => {
+    const result = await ctx.ui.input(title, placeholder, { timeout: OAUTH_MANUAL_INPUT_TIMEOUT_MS, signal: controller.signal });
+    if (result === undefined) throw new Error("OAuth login cancelled");
+    return result;
+  };
+  try {
+    return await run(readCode, () => controller.abort());
+  } finally {
+    controller.abort();
+  }
+}
+
 async function loginProvider(providerId: ManagedProviderId, ctx: ExtensionContext) {
   if (providerId === ANTHROPIC_PROVIDER_ID) {
     let authorizeUrl: string | undefined;
-    return loginAnthropic({
+    return loginWithManualInputCleanup(ctx, (readCode, dismissManual) =>
+      loginAnthropic({
+        onAuth: ({ url, instructions }) => {
+          authorizeUrl = url;
+          // Best-effort for the local attach case where a browser is reachable; on a
+          // headless remote box this opens nothing and the URL embedded in the
+          // manual-code dialog title below (rendered as a tappable link on web) is
+          // the real path.
+          openBrowser(url);
+          if (instructions) ctx.ui.notify(instructions, "info");
+        },
+        onPrompt: async (prompt) => (await ctx.ui.input(prompt.message, prompt.placeholder ?? "")) ?? "",
+        // Fires only once pi-ai already has a code (its exchange step) -- the
+        // race-winner boundary. Dismiss the losing manual dialog NOW, before the
+        // token exchange, rather than waiting on it (review mrf68z4h).
+        onProgress: (message) => {
+          dismissManual();
+          ctx.ui.notify(message, "info");
+        },
+        onManualCodeInput: () =>
+          readCode(
+            `Open this URL to authenticate Claude:\n${authorizeUrl}\n\nPaste the redirect URL or code`,
+            "http://localhost:53692/callback?...",
+          ),
+      }),
+    );
+  }
+
+  let authorizeUrl: string | undefined;
+  return loginWithManualInputCleanup(ctx, (readCode, dismissManual) =>
+    loginOpenAICodex({
       onAuth: ({ url, instructions }) => {
         authorizeUrl = url;
         // Best-effort for the local attach case where a browser is reachable; on a
-        // headless remote box this opens nothing and the URL below is the real path.
+        // headless remote box this opens nothing and the URL embedded in the
+        // manual-code dialog title below (rendered as a tappable link on web) is
+        // the real path.
         openBrowser(url);
         if (instructions) ctx.ui.notify(instructions, "info");
       },
       onPrompt: async (prompt) => (await ctx.ui.input(prompt.message, prompt.placeholder ?? "")) ?? "",
-      onProgress: (message) => ctx.ui.notify(message, "info"),
-      onManualCodeInput: async () =>
-        (await ctx.ui.input(
-          `Open this URL to authenticate Claude:\n${authorizeUrl}\n\nPaste the redirect URL or code`,
-          "http://localhost:53692/callback?...",
-          { timeout: OAUTH_MANUAL_INPUT_TIMEOUT_MS },
-        )) ?? "",
-    });
-  }
-
-  let authorizeUrl: string | undefined;
-  return loginOpenAICodex({
-    onAuth: ({ url, instructions }) => {
-      authorizeUrl = url;
-      // Best-effort for the local attach case where a browser is reachable; on a
-      // headless remote box this opens nothing and the URL below is the real path.
-      openBrowser(url);
-      if (instructions) ctx.ui.notify(instructions, "info");
-    },
-    onPrompt: async (prompt) => (await ctx.ui.input(prompt.message, prompt.placeholder ?? "")) ?? "",
-    onProgress: (message) => ctx.ui.notify(message, "info"),
-    onManualCodeInput: async () =>
-      (await ctx.ui.input(
-        `Open this URL to authenticate OpenAI Codex:\n${authorizeUrl}\n\nPaste the redirect URL or code`,
-        "http://localhost:1455/auth/callback?...",
-        { timeout: OAUTH_MANUAL_INPUT_TIMEOUT_MS },
-      )) ?? "",
-  });
+      // pi-ai's OpenAI browser path emits no progress between callback-win and
+      // exchange, so this dismisses at the exchange step when present; the
+      // finally-abort backstop covers the (bounded-by-dialog-timeout) gap.
+      onProgress: (message) => {
+        dismissManual();
+        ctx.ui.notify(message, "info");
+      },
+      onManualCodeInput: () =>
+        readCode(
+          `Open this URL to authenticate OpenAI Codex:\n${authorizeUrl}\n\nPaste the redirect URL or code`,
+          "http://localhost:1455/auth/callback?...",
+        ),
+    }),
+  );
 }
 
 export default async function (pi: ExtensionAPI): Promise<void> {
@@ -832,13 +979,14 @@ export default async function (pi: ExtensionAPI): Promise<void> {
       }
 
       const action = verb === "rm" ? "remove" : verb || "list";
-      const pool = readSubscriptionPool(providerId);
 
       if (action === "status" || action === "list") {
+        const pool = readSubscriptionPool(providerId);
         const lines = [formatStatusLine(providerId), ""];
         for (const [index, entry] of pool.entries()) {
           const cooldown = entry.rateLimitedUntil > Date.now() ? ` cooldown=${Math.ceil((entry.rateLimitedUntil - Date.now()) / 1000)}s` : "";
-          lines.push(`${index + 1}. ${entry.label}${cooldown}`);
+          const account = entry.accountId ? ` account=${shortAccountId(entry.accountId)}` : "";
+          lines.push(`${index + 1}. ${entry.label}${account}${cooldown}`);
         }
         ctx.ui.notify(lines.join("\n"), "info");
         return;
@@ -849,7 +997,8 @@ export default async function (pi: ExtensionAPI): Promise<void> {
           ctx.ui.notify(`${getProviderLabel(providerId)} login requires an interactive UI.`, "error");
           return;
         }
-        const label = rest.join(" ") || (await ctx.ui.input(`${getProviderLabel(providerId)} subscription label`, providerId));
+        const pool = readSubscriptionPool(providerId);
+        const label = (rest.join(" ") || (await ctx.ui.input(`${getProviderLabel(providerId)} subscription label`, providerId)) || "").trim();
         if (!label) return;
         // The default label (`label === providerId`) is the OAuth-login-linked default slot,
         // whose live value lives exclusively in auth.json (design §1/§3). Accepting it bypasses
@@ -863,18 +1012,32 @@ export default async function (pi: ExtensionAPI): Promise<void> {
         }
         try {
           const cred = await activeLoginForProvider(providerId, ctx);
+          const accountId = loginAccountId(cred);
           if (isDefaultLabel) {
-            // Same single-owner write as `reauthenticateCredential`'s default branch: persist
-            // to auth.json through the same locked FileAuthStorageBackend seam; the
-            // metadata-only pool entry is (re)created on next read.
-            await persistDefaultSlotCredential(providerId, cred);
-            markSubscriptionSuccess(providerId, providerId, Date.now());
+            // Atomically commit the default login: validate account-uniqueness (excluding the
+            // default slot), persist auth.json, then reflect identity and causally reconcile the
+            // metadata-only cooldown under the pool lock. A collision rejects before auth.json
+            // switches, and a newer same-account 429 recorded during OAuth remains authoritative.
+            commitDefaultIdentity(providerId, {
+              refresh: cred.refresh,
+              access: cred.access,
+              expires: cred.expires,
+              accountId,
+              lastRateLimitedAt: pool.find((entry) => entry.label === providerId)?.lastRateLimitedAt ?? 0,
+            });
           } else {
-            upsertSubscription(providerId, {
+            // Enforce label + Codex account uniqueness ATOMICALLY inside the pool lock: a sticky
+            // browser session (or two brokers finishing OAuth together) must not land the same
+            // quota under a second label. addSubscription throws DuplicateSubscriptionError,
+            // surfaced by the catch below. The account check also catches a collision with the
+            // default slot. Anthropic has no programmatic account identity, so its duplicate
+            // protection stays a validation-procedure obligation, not a code check.
+            addSubscription(providerId, {
               label,
               refresh: cred.refresh,
               access: cred.access,
               expires: cred.expires,
+              ...(accountId ? { accountId } : {}),
               rateLimitedUntil: 0,
               lastAttemptAt: 0,
               lastRateLimitedAt: 0,
@@ -913,7 +1076,7 @@ export default async function (pi: ExtensionAPI): Promise<void> {
           return;
         }
         try {
-          removeSubscription(providerId, ref);
+          removeManagedAccount(providerId, ref);
           logRotation(`removed ${getProviderLabel(providerId)} subscription "${ref}"`);
           ctx.ui.notify(`Removed ${getProviderLabel(providerId)} subscription: ${ref}`, "info");
           updateRotationStatus(ctx);

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/statusline.ts

@@ -7,15 +7,8 @@
  *                      shown only when a name is set (via /name or
  *                      pi.setSessionName()).
  *
- * NOTE: this extension used to also render a "crtr subagent bar" by polling
- * `crtr agent session list` / `crtr agent session show`. Those subcommands were
- * removed in the canvas refactor (commit 9e141f0). Because crtr's front-door
- * treats any unrecognized first token as a prompt and boots a fresh root pi
- * (spawnSync('pi', ...)), each poll spawned a new pi that re-loaded this
- * extension and polled again — an unbounded fork bomb on startup. Canvas
- * navigation now lives in crtr's own `canvas-nav` extension (injected into every
- * node via `-e`), which reads the canvas in-process and navigates with
- * `crtr node focus`. The agent bar has been retired here accordingly.
+ * This extension owns only the statusline and session-name badge. Canvas
+ * navigation and interactive chrome live in crouter's attach viewer.
  */
 
 import { execFile } from "node:child_process";