@crouton-kit/crouter 0.3.81 → 0.3.83

package/dist/core/runtime/package-health.d.ts

@@ -4,6 +4,19 @@ export interface MissingPackage {
     /** Absolute path it resolved to (which does not exist). */
     resolved: string;
 }
+/**
+ * The pi agent config dir (`~/.pi/agent`, or `$PI_CODING_AGENT_DIR`) — a local
+ * reimplementation of pi's `getAgentDir()`. Reimplemented (not imported) ON
+ * PURPOSE: `getAgentDir` lives in `@earendil-works/pi-coding-agent`, and
+ * importing that package pulls in the ENTIRE ~360ms pi engine module graph. The
+ * front door calls this on every bare-`crtr` boot BEFORE spawning the broker, so
+ * a static/dynamic pi import here adds ~316ms of serialized dead-time in the
+ * foreground before the broker (which loads pi itself) even starts. This mirrors
+ * pi's contract exactly: `$PI_CODING_AGENT_DIR` (tilde-expanded) else
+ * `~/.pi/agent`. Same precedent as `bearings.ts` (keep the pi engine out of the
+ * hot/foreground path). If pi ever rebrands its configDir/env, update here.
+ */
+export declare function piAgentDir(homeDir?: string): string;
 /**
  * Return every local-path package in `<agentDir>/settings.json` whose resolved
  * path is missing. Empty when settings is absent/unreadable or all paths exist.

package/dist/core/runtime/package-health.js

@@ -21,6 +21,24 @@ function expandTilde(pathValue, homeDir) {
         return join(homeDir, pathValue.slice(2));
     return pathValue;
 }
+/**
+ * The pi agent config dir (`~/.pi/agent`, or `$PI_CODING_AGENT_DIR`) — a local
+ * reimplementation of pi's `getAgentDir()`. Reimplemented (not imported) ON
+ * PURPOSE: `getAgentDir` lives in `@earendil-works/pi-coding-agent`, and
+ * importing that package pulls in the ENTIRE ~360ms pi engine module graph. The
+ * front door calls this on every bare-`crtr` boot BEFORE spawning the broker, so
+ * a static/dynamic pi import here adds ~316ms of serialized dead-time in the
+ * foreground before the broker (which loads pi itself) even starts. This mirrors
+ * pi's contract exactly: `$PI_CODING_AGENT_DIR` (tilde-expanded) else
+ * `~/.pi/agent`. Same precedent as `bearings.ts` (keep the pi engine out of the
+ * hot/foreground path). If pi ever rebrands its configDir/env, update here.
+ */
+export function piAgentDir(homeDir = homedir()) {
+    const envDir = process.env['PI_CODING_AGENT_DIR'];
+    if (envDir !== undefined && envDir !== '')
+        return expandTilde(envDir, homeDir);
+    return join(homeDir, '.pi', 'agent');
+}
 /** A `packages[]` entry is a LOCAL PATH (not an npm ref) — the only kind that
  *  can go stale on a repo move. `npm:...` and bare registry names resolve
  *  through node/npm, not the filesystem, so they are out of scope here. */

package/dist/core/runtime/pi-vendored.js

@@ -21,9 +21,23 @@ import { join } from 'node:path';
  *  the sessions dir — same vendoring rationale as the slash-command list below. */
 export function piSessionsRoot() {
     const env = process.env['PI_CODING_AGENT_DIR'];
-    const agentDir = env !== undefined && env !== '' ? env : join(homedir(), '.pi', 'agent');
+    const agentDir = env !== undefined && env !== '' ? expandTilde(env) : join(homedir(), '.pi', 'agent');
     return join(agentDir, 'sessions');
 }
+/** Mirror pi's `expandTildePath` (= `normalizePath` with the default expandTilde
+ *  on): a bare `~` is the home dir, and a leading `~/` (or `~\` on win32) joins
+ *  the remainder under home. pi's `getAgentDir()` runs `PI_CODING_AGENT_DIR`
+ *  through this, so the vendored root must too or `~/custom-pi` yields a broken
+ *  relative path. Other forms (absolute, relative, `~user`) pass through as pi
+ *  leaves them. */
+function expandTilde(p) {
+    if (p === '~')
+        return homedir();
+    if (p.startsWith('~/') || (process.platform === 'win32' && p.startsWith('~\\'))) {
+        return join(homedir(), p.slice(2));
+    }
+    return p;
+}
 /**
  * pi's builtin slash commands — vendored verbatim from pi `core/slash-commands.js`
  * `BUILTIN_SLASH_COMMANDS` (review C1). **21 entries at 0.78.1** (review n1 — NOT 23).

package/dist/core/runtime/placement.d.ts

@@ -12,16 +12,6 @@ export declare function focusByPane(pane: string): FocusRow | null;
 export declare function focusedNodes(): Set<string>;
 /** Every live viewer row (GC'ing any whose pane has gone). */
 export declare function listFocuses(): FocusRow[];
-/** The on-screen viewer a human-in-the-loop prompt raised by `nodeId` should
- *  surface into: the HIGHEST node of nodeId's graph that has a viewer — the
- *  viewer closest to the graph root, i.e. the session/window the user is actually
- *  watching this work in. Walks nodeId's spine to its root, enumerates the whole
- *  tree root-first (`view` is BFS ⇒ shallowest first), and returns the viewer row
- *  of the first node that has one. null when nothing in the graph is on screen —
- *  the caller then surfaces in the user's attached pane. PURE (db reads only): no
- *  tmux probe, so the pane may be stale; the caller liveness-checks before
- *  targeting it. */
-export declare function graphSurfaceTarget(nodeId: string): FocusRow | null;
 /** Wait until a broker's view.sock accepts a connection. The launching caller
  *  stays async, so the broker's real exit signal can fail fast the wait instead
  *  of being masked by a zombie pid. Success proves more than file existence: it
@@ -84,6 +74,7 @@ export declare function openViewerWindow(nodeId: string, session: string, opts?:
 export declare function focus(nodeId: string, opts: {
     pane?: string;
     newPane?: boolean;
+    inPlace?: boolean;
     revive: Reviver;
 }): Promise<FocusResult>;
 /** Tear a node off its viewer (close/reset/cancel teardown). The broker engine

package/dist/core/runtime/placement.js

@@ -24,11 +24,11 @@
 //     tmux-chrome.ts import tmux.ts") holds — every other module reaches the
 //     driver verbs through here.
 import { createConnection } from 'node:net';
-import { getNode, deleteNode, listNodes, openFocusRow, closeFocusRow, getFocusByNode, getFocusByPane, getFocusById, listFocuses as listFocusRows, view, } from '../canvas/index.js';
+import { getNode, fullName, deleteNode, listNodes, openFocusRow, closeFocusRow, getFocusByNode, getFocusByPane, getFocusById, listFocuses as listFocusRows, } from '../canvas/index.js';
 import { nodeHasAssistantMessage, isNodeStreaming } from '../canvas/render.js';
 import { headlessBrokerHost } from './host.js';
-import { paneExists, paneLocation, ensureSession, openNodeWindow, splitWindow, closePane, currentTmux, switchClient, selectWindow, selectLayout, selectPane, getPaneOption, } from './tmux.js';
-import { newNodeId, rootOfSpine } from './nodes.js';
+import { paneExists, paneLocation, ensureSession, openNodeWindow, splitWindow, closePane, currentTmux, switchClient, selectWindow, selectLayout, selectPane, getPaneOption, setPaneOption, respawnPaneSync, windowOfPane, renameWindow, } from './tmux.js';
+import { newNodeId } from './nodes.js';
 import { viewSocketPath } from '../canvas/paths.js';
 import { isPidAlive } from '../canvas/pid.js';
 // Placement is the sanctioned model-over-driver (§2.1): non-placement runtime /
@@ -61,8 +61,7 @@ installTmuxBindings as installMenuBinding, setPaneOption, getPaneOption, piComma
 //
 // GC is lazy on read: a row whose viewer pane no longer exists (the user closed
 // the window, the attach client died) is pruned the next time it is read, so the
-// registry self-heals without a sweeper. (graphSurfaceTarget stays pure — no
-// tmux probe — by design; its caller liveness-checks the pane it returns.)
+// registry self-heals without a sweeper.
 // ---------------------------------------------------------------------------
 /** Prune a viewer row whose pane is gone; return it iff its pane is still live. */
 function liveOrPrune(f) {
@@ -100,27 +99,6 @@ export function listFocuses() {
     return live;
 }
 // ---------------------------------------------------------------------------
-// Graph → viewer routing (for surfacing human-in-the-loop prompts)
-// ---------------------------------------------------------------------------
-/** The on-screen viewer a human-in-the-loop prompt raised by `nodeId` should
- *  surface into: the HIGHEST node of nodeId's graph that has a viewer — the
- *  viewer closest to the graph root, i.e. the session/window the user is actually
- *  watching this work in. Walks nodeId's spine to its root, enumerates the whole
- *  tree root-first (`view` is BFS ⇒ shallowest first), and returns the viewer row
- *  of the first node that has one. null when nothing in the graph is on screen —
- *  the caller then surfaces in the user's attached pane. PURE (db reads only): no
- *  tmux probe, so the pane may be stale; the caller liveness-checks before
- *  targeting it. */
-export function graphSurfaceTarget(nodeId) {
-    const root = rootOfSpine(nodeId);
-    for (const id of [root, ...view(root)]) {
-        const f = getFocusByNode(id);
-        if (f !== null && f.pane !== null)
-            return f;
-    }
-    return null;
-}
-// ---------------------------------------------------------------------------
 // view.sock readiness — the one shared broker-cold-start primitive
 // ---------------------------------------------------------------------------
 const BROKER_FOCUS_SOCKET_WAIT_MS = 30_000;
@@ -311,6 +289,45 @@ export async function focus(nodeId, opts) {
     // split pane's location — the caller's own session.
     const callerSession = paneLocation(callerPane)?.session ?? null;
     const fallbackSession = callerSession ?? '';
+    // (b0) --in-place → the CALLER pane BECOMES this node's viewer, replacing
+    //      whatever it showed (the attach subagent scroll+swap: ↓ into the reports
+    //      roster, Enter dives into that child right here, no new split). This
+    //      re-execs the caller pane via `respawn-pane -k`, so it MUST be driven
+    //      from OUTSIDE that pane's process tree (the viewer shells this through
+    //      `tmux run-shell`, never a direct child) — else the respawn kills its own
+    //      driver mid-call. Move the child's viewer here if it had one elsewhere
+    //      (UNIQUE one-viewer-per-node) and drop the caller pane's prior viewer row
+    //      (that node's broker keeps running headless, reconnectable by a later
+    //      focus). The respawned `crtr surface attach` replays scrollback from the
+    //      welcome snapshot and self-tags the pane `@crtr_node`.
+    if (opts.inPlace === true) {
+        const prior = focusOf(nodeId);
+        if (prior !== null) {
+            if (prior.pane !== null && prior.pane !== callerPane && paneExists(prior.pane))
+                closePane(prior.pane);
+            closeFocusRow(prior.focus_id);
+        }
+        const here = getFocusByPane(callerPane);
+        if (here !== null && here.node_id !== nodeId)
+            closeFocusRow(here.focus_id);
+        // Clear the stale tag before respawn so it never names the wrong node during
+        // the gap before the fresh attach re-tags on connect.
+        try {
+            setPaneOption(callerPane, '@crtr_node', '');
+        }
+        catch { /* best-effort */ }
+        const window = windowOfPane(callerPane);
+        // Continuity: the fresh viewer re-enters the inline roster on the node just
+        // swapped to (self), so the user keeps scrolling from where they were rather
+        // than being dropped back into the text box.
+        const ok = respawnPaneSync({ pane: callerPane, cwd: meta.cwd, env: { ...viewerSplitEnv(), CRTR_ATTACH_ROSTER: '1' }, command: `crtr surface attach to ${nodeId}` });
+        if (ok) {
+            if (window !== null)
+                renameWindow(window, fullName(meta));
+            registerViewerFocus(nodeId, callerPane, callerSession, window);
+        }
+        return { focused: ok, session: callerSession, inPlace: true, revived };
+    }
     // (b) --new-pane → always a fresh viewer beside the caller. Drop any prior
     //     viewer this node holds elsewhere (UNIQUE(node_id): one viewer per node).
     if (opts.newPane === true) {

package/dist/core/runtime/resume.js

@@ -15,7 +15,9 @@
 import { spawn } from 'node:child_process';
 import { emitKeypressEvents } from 'node:readline';
 import { getNode, listResumableRoots } from '../canvas/index.js';
+import { navLabel } from '../canvas/nav-model.js';
 import { isPidAlive } from '../canvas/pid.js';
+import { readGoal } from './kickoff.js';
 import { reviveNode } from './revive.js';
 import { installTmuxBindings } from './tmux-chrome.js';
 import { registerViewerFocus, waitForBrokerViewSocket, viewerSplitEnv, currentTmux, inTmux, } from './placement.js';
@@ -109,17 +111,81 @@ async function attachInline(nodeId, cwd) {
 const HILITE = accent('\u25b8');
 const cursorUp = (n) => (n > 0 ? `\u001b[${n}A\r` : '');
 const CLEAR_DOWN = '\u001b[0J';
+const ANSI_RE = /\u001b\[[0-9;]*m/g;
+/** Terminal rows a just-written block occupies — counts each '\n' AND the extra
+ *  rows a long line WRAPS into at the current terminal width (ANSI color codes
+ *  stripped so they don't inflate the width). A plain newline count undershoots
+ *  in a narrow pane, so redraws stack instead of clearing. Mirrors the
+ *  profile-menu blockRows. */
+function blockRows(block) {
+    const cols = process.stdout.columns ?? 80;
+    const segs = block.split('\n');
+    const newlines = segs.length - 1; // block ends with '\n' → last seg is ''
+    let extra = 0;
+    for (let i = 0; i < newlines; i++) {
+        const w = segs[i].replace(ANSI_RE, '').length;
+        if (cols > 0 && w > cols)
+            extra += Math.ceil(w / cols) - 1;
+    }
+    return newlines + extra;
+}
+/** Truncate to a visible-column budget, preserving ANSI escapes (they cost no
+ *  width). Appends '…' when it cuts. Keeps a styled row on one terminal line so
+ *  nothing wraps. */
+function fitWidth(s, width) {
+    if (width <= 0)
+        return s;
+    let out = '';
+    let vis = 0;
+    for (let i = 0; i < s.length;) {
+        if (s[i] === '\u001b') {
+            const m = /^\u001b\[[0-9;]*m/.exec(s.slice(i));
+            if (m !== null) {
+                out += m[0];
+                i += m[0].length;
+                continue;
+            }
+        }
+        if (vis >= width - 1 && s.replace(ANSI_RE, '').length > width) {
+            out += '\u2026';
+            break;
+        }
+        out += s[i];
+        vis++;
+        i++;
+    }
+    return out;
+}
 function label(r) {
     // Liveness is the broker pid, not the row status: a dormant resident root
     // keeps status='active' while its engine is down.
     const live = isPidAlive(r.pi_pid ?? null) ? accent('\u25cf live') : dim('\u25cb dormant');
-    const name = r.name && r.name !== r.kind ? r.name : `${r.kind} root`;
+    // The SAME handle the Alt-G graph shows: navLabel = name → description → kind.
+    // getNode carries `description` (NodeRow from the list query does not).
+    const node = getNode(r.node_id);
+    let name = navLabel(node, r.node_id);
+    // navLabel falls back to the bare kind for a never-named root — useless in a
+    // roster where every root is 'general'. Rescue it with the goal's first line
+    // (the spawning prompt), so unnamed convos are still tellable apart.
+    if (node !== null && name === node.kind) {
+        const goal = firstLine(readGoal(r.node_id));
+        if (goal !== '')
+            name = goal;
+    }
     return `${name}  ${live}`;
 }
+/** First non-empty line of a goal body, trimmed and length-capped. */
+function firstLine(text) {
+    if (text === null)
+        return '';
+    const line = text.split('\n').map((l) => l.trim()).find((l) => l !== '') ?? '';
+    return line.length > 72 ? line.slice(0, 71) + '\u2026' : line;
+}
 function detail(r, cwd) {
     const when = ago(r.created);
     const where = r.cwd === cwd ? '' : `  ${r.cwd}`;
-    return `${r.node_id}  ${when}${where}`;
+    // Short id keeps the row on one line; the full id is rarely needed to pick.
+    return `${when}${where}  ${r.node_id.slice(0, 8)}`;
 }
 function ago(iso) {
     const ms = Date.now() - new Date(iso).getTime();
@@ -147,11 +213,13 @@ function pickRoot(roots, cwd) {
         let sel = 0;
         let prevLines = 0;
         const render = () => {
+            const cols = process.stdout.columns ?? 80;
             let s = `\n  ${bold(title)}\n  ${dim(subtitle)}\n\n`;
             roots.forEach((r, i) => {
                 const mark = i === sel ? HILITE : ' ';
                 const slot = i < 9 ? key(`${i + 1}`) : '  ';
-                s += `  ${mark} ${slot}  ${label(r)}  ${dim(detail(r, cwd))}\n`;
+                const row = `  ${mark} ${slot}  ${label(r)}  ${dim(detail(r, cwd))}`;
+                s += fitWidth(row, cols) + '\n';
             });
             s += `\n  ${dim('↑/↓ move  enter resume  q quit')}\n`;
             return s;
@@ -159,7 +227,7 @@ function pickRoot(roots, cwd) {
         const draw = () => {
             const block = render();
             out.write((prevLines > 0 ? cursorUp(prevLines) + CLEAR_DOWN : '') + block);
-            prevLines = block.split('\n').length - 1;
+            prevLines = blockRows(block);
         };
         emitKeypressEvents(input);
         const wasRaw = input.isRaw ?? false;

package/dist/core/runtime/session-list-cache.d.ts

@@ -7,7 +7,13 @@ export declare function compactSessionSearchText(text: string): string;
 export declare class SessionListCache {
     private readonly cacheFile;
     private cache;
-    private loaded;
+    /** In-flight cwd scans keyed by normalized session dir, so an immediate
+     *  /resume that races the background prewarm (or a second identical open)
+     *  shares the one running jsonlFiles/stat/build pass instead of queueing a
+     *  redundant one behind it. */
+    private inflightDir;
+    private loadPromise;
+    private buildChain;
     private persisting;
     private persistAgain;
     private persistTimer;
@@ -18,12 +24,26 @@ export declare class SessionListCache {
      *  broker loop — pre-warming beats worker threads here. Errors are swallowed
      *  by the same paths that guard a normal open. */
     prewarm(sessionDir: string): void;
-    /** Sessions for one cwd's session dir (the picker's default `cwd` scope). */
+    /** Sessions for one cwd's session dir (the picker's default `cwd` scope).
+     *  Single-flight: an identical concurrent cwd open (prewarm ⇄ immediate
+     *  /resume) shares the in-flight promise rather than repeating the scan.
+     *  Incompatible cwd/all builds still serialize through the build chain. */
     listDir(sessionDir: string): Promise<WireSessionInfo[]>;
+    private buildDir;
     /** Sessions across every cwd's dir under the sessions root (`all` scope). */
     listAll(sessionsRoot: string): Promise<WireSessionInfo[]>;
+    /** Serialize builds through a single chain: they mutate the shared cache map
+     *  and, cold, scan the same large corpus. Identical cwd opens are already
+     *  collapsed upstream by `listDir`'s in-flight sharing; chaining serializes
+     *  the remaining incompatible builds (a cwd scan vs an `all` scan) so they
+     *  never race map mutation or launch overlapping cold scans. */
     private build;
+    private buildLocked;
+    /** Load the persisted cache exactly once, single-flight. Returns a shared
+     *  promise so a build that starts while the read is still in flight awaits the
+     *  same load rather than proceeding against a not-yet-populated map. */
     private ensureLoaded;
+    private loadFromDisk;
     /** Coalesce persists onto a single trailing timer so the tens-of-MB
      *  `JSON.stringify` never runs on the reply path and rapid opens write once. */
     private schedulePersist;

package/dist/core/runtime/session-list-cache.js

@@ -19,7 +19,7 @@
 import { createReadStream } from 'node:fs';
 import { readFile, readdir, rename, stat, unlink, writeFile } from 'node:fs/promises';
 import { createInterface } from 'node:readline';
-import { dirname, join } from 'node:path';
+import { dirname, join, normalize } from 'node:path';
 /** Search-text bound: `allMessagesText` is searched on every query edit; pi's
  *  unbounded value retains gigabytes in the viewer and turns key-repeat into GC
  *  jitter. The opening and latest text keep search useful. */
@@ -41,18 +41,41 @@ const CACHE_SCHEMA_VERSION = 1;
  *  are coalesced onto this trailing timer so rapid opens write at most once per
  *  window, off the hot path. */
 const PERSIST_DEBOUNCE_MS = 2000;
+function isFiniteNonNeg(v) {
+    return typeof v === 'number' && Number.isFinite(v) && v >= 0;
+}
+/** An optional field is valid iff absent/undefined or a string. */
+function isOptionalString(v) {
+    return v === undefined || typeof v === 'string';
+}
+/** Validate the full persisted `WireSessionInfo` shape. A same-version file whose
+ *  entry drifts from the current wire schema (any required field missing or
+ *  mistyped, any optional field the wrong type, non-finite/negative metadata)
+ *  must discard the whole cache and rebuild rather than feed a malformed entry to
+ *  the viewer or the sort. */
+function isValidWireInfo(v) {
+    if (typeof v !== 'object' || v === null)
+        return false;
+    const i = v;
+    return (typeof i['path'] === 'string' &&
+        typeof i['id'] === 'string' &&
+        typeof i['cwd'] === 'string' &&
+        typeof i['created'] === 'string' &&
+        typeof i['modified'] === 'string' &&
+        isFiniteNonNeg(i['messageCount']) &&
+        typeof i['firstMessage'] === 'string' &&
+        typeof i['allMessagesText'] === 'string' &&
+        isOptionalString(i['name']) &&
+        isOptionalString(i['parentSessionPath']));
+}
 /** Shape-check a loaded entry — a well-formed-JSON file with the right version
- *  but a stale entry shape (e.g. missing `info`) would otherwise push undefined
- *  into the sort and throw. Any failure discards the whole file (rebuild). */
+ *  but a stale entry shape would otherwise feed a malformed `WireSessionInfo` to
+ *  the viewer/sort. Any failure discards the whole file (rebuild). */
 function isValidEntry(e) {
     if (typeof e !== 'object' || e === null)
         return false;
     const c = e;
-    return (typeof c['mtimeMs'] === 'number' &&
-        typeof c['size'] === 'number' &&
-        typeof c['info'] === 'object' &&
-        c['info'] !== null &&
-        typeof c['info']['modified'] === 'string');
+    return isFiniteNonNeg(c['mtimeMs']) && isFiniteNonNeg(c['size']) && isValidWireInfo(c['info']);
 }
 // ---- faithful mirror of pi's private buildSessionInfo -----------------------
 function parseLine(line) {
@@ -172,7 +195,13 @@ async function buildWireSessionInfo(filePath) {
 export class SessionListCache {
     cacheFile;
     cache = new Map();
-    loaded = false;
+    /** In-flight cwd scans keyed by normalized session dir, so an immediate
+     *  /resume that races the background prewarm (or a second identical open)
+     *  shares the one running jsonlFiles/stat/build pass instead of queueing a
+     *  redundant one behind it. */
+    inflightDir = new Map();
+    loadPromise = null;
+    buildChain = Promise.resolve();
     persisting = false;
     persistAgain = false;
     persistTimer = null;
@@ -187,9 +216,32 @@ export class SessionListCache {
     prewarm(sessionDir) {
         void this.listDir(sessionDir);
     }
-    /** Sessions for one cwd's session dir (the picker's default `cwd` scope). */
-    async listDir(sessionDir) {
-        return this.build(await jsonlFiles(sessionDir), new Set([sessionDir]));
+    /** Sessions for one cwd's session dir (the picker's default `cwd` scope).
+     *  Single-flight: an identical concurrent cwd open (prewarm ⇄ immediate
+     *  /resume) shares the in-flight promise rather than repeating the scan.
+     *  Incompatible cwd/all builds still serialize through the build chain. */
+    listDir(sessionDir) {
+        const key = normalize(sessionDir);
+        const existing = this.inflightDir.get(key);
+        if (existing)
+            return existing;
+        const op = this.buildDir(key);
+        this.inflightDir.set(key, op);
+        // Attach both settlement handlers so the slot is cleared on success OR
+        // rejection, a rejected scan can never poison the next open, and a
+        // discarded prewarm rejection never becomes unhandled.
+        const clear = () => {
+            if (this.inflightDir.get(key) === op)
+                this.inflightDir.delete(key);
+        };
+        op.then(clear, clear);
+        return op;
+    }
+    buildDir(sessionDir) {
+        // Prune only keys directly in this cwd's dir. A cwd-scope open must not evict
+        // other cwds' cached entries: they weren't rescanned, so their absence from
+        // `files` says nothing about whether they still exist on disk.
+        return jsonlFiles(sessionDir).then((files) => this.build(files, (key) => dirname(key) === sessionDir));
     }
     /** Sessions across every cwd's dir under the sessions root (`all` scope). */
     async listAll(sessionsRoot) {
@@ -205,19 +257,30 @@ export class SessionListCache {
         const files = [];
         for (const dir of dirEntries)
             files.push(...(await jsonlFiles(dir)));
-        return this.build(files, new Set(dirEntries));
+        // Prune every cached key that is a direct grandchild of the sessions root
+        // (`<root>/<cwd-dir>/<file>.jsonl`). Using the path boundary rather than the
+        // set of dirs that still exist means a wholly-deleted cwd dir — absent from
+        // this scan — also has its stale entries evicted, so the persisted file never
+        // accumulates bloat from removed cwds.
+        return this.build(files, (key) => dirname(dirname(key)) === sessionsRoot);
+    }
+    /** Serialize builds through a single chain: they mutate the shared cache map
+     *  and, cold, scan the same large corpus. Identical cwd opens are already
+     *  collapsed upstream by `listDir`'s in-flight sharing; chaining serializes
+     *  the remaining incompatible builds (a cwd scan vs an `all` scan) so they
+     *  never race map mutation or launch overlapping cold scans. */
+    build(files, shouldPrune) {
+        const run = this.buildChain.then(() => this.buildLocked(files, shouldPrune));
+        // Keep the chain alive past a rejected build without leaking the rejection.
+        this.buildChain = run.then(() => { }, () => { });
+        return run;
     }
-    async build(files, scannedDirs) {
+    async buildLocked(files, shouldPrune) {
         await this.ensureLoaded();
         const present = new Set(files);
         let changed = false;
-        // Prune ONLY keys under the dirs we actually scanned. A cwd-scope open must
-        // not evict other cwds' cached entries: they weren't rescanned, so their
-        // absence from `files` says nothing about whether they still exist on disk.
-        // (Pruning the whole map here would self-destruct the global/`all` cache on
-        // every cwd open.)
         for (const key of this.cache.keys()) {
-            if (!present.has(key) && scannedDirs.has(dirname(key))) {
+            if (!present.has(key) && shouldPrune(key)) {
                 this.cache.delete(key);
                 changed = true;
             }
@@ -262,10 +325,15 @@ export class SessionListCache {
         result.sort((a, b) => new Date(b.modified).getTime() - new Date(a.modified).getTime());
         return result;
     }
-    async ensureLoaded() {
-        if (this.loaded)
-            return;
-        this.loaded = true;
+    /** Load the persisted cache exactly once, single-flight. Returns a shared
+     *  promise so a build that starts while the read is still in flight awaits the
+     *  same load rather than proceeding against a not-yet-populated map. */
+    ensureLoaded() {
+        if (!this.loadPromise)
+            this.loadPromise = this.loadFromDisk();
+        return this.loadPromise;
+    }
+    async loadFromDisk() {
         try {
             const raw = JSON.parse(await readFile(this.cacheFile, 'utf8'));
             // Version mismatch or shape drift → discard and rebuild. No lenient

package/dist/core/runtime/spawn.js

@@ -24,6 +24,7 @@ import { appendSituationalContext } from './situational-context.js';
 import { hasRoadmap, seedRoadmap } from './roadmap.js';
 import { buildIdentityAssertion, buildWakeBearings } from './bearings.js';
 import { installTmuxBindings } from './tmux-chrome.js';
+import { installInboxBinding } from '@crouton-kit/humanloop';
 import { getNode, fullName, recordPid } from '../canvas/index.js';
 import { registerViewerFocus, openViewerWindow, waitForBrokerViewSocket, viewerSplitEnv, windowOfPane, currentTmux, inTmux, focusWindow, } from './placement.js';
 import { transition } from './lifecycle.js';
@@ -102,6 +103,14 @@ export async function bootRoot(opts) {
         installTmuxBindings();
     }
     catch { /* best-effort */ }
+    // Reconcile humanloop's collision-safe M-i inbox popup binding on the same
+    // server so the inbox is reachable from any window. Crouter calls humanloop's
+    // installer — it never authors or parses its own tmux command; the installer
+    // is idempotent and leaves any pre-existing M-i binding untouched.
+    try {
+        installInboxBinding();
+    }
+    catch { /* best-effort */ }
     // This terminal becomes the root's attach VIEWER in the user's CURRENT session,
     // so its window stays where the user already is. The node row carries NO
     // presence — a broker node's pane/window/tmux_session stay NULL; the viewer

package/dist/core/spawn.d.ts

@@ -14,62 +14,3 @@ export declare function isInTmux(): boolean;
  *  degrade to the inbox-drain follow-up. */
 export declare function tmuxServerReachable(): boolean;
 export declare function shellQuote(s: string): string;
-/** Count panes in a tmux window (0 outside tmux / on error). With `targetPane`,
- *  counts the window THAT pane lives in (the placement decision must reflect the
- *  window the new pane will actually open into, not the caller's backstage one);
- *  without it, the caller's current window. */
-export declare function countPanesInWindow(targetPane?: string): number;
-/** Back-compat alias: panes in the caller's current window. */
-export declare function countPanesInCurrentWindow(): number;
-/** Does this tmux pane id still exist? `display-message` EXITS 0 with EMPTY
- *  output on an unresolvable pane, so test for non-empty stdout, not just `.ok`.
- *  False outside tmux / on error. */
-export declare function paneAlive(pane: string): boolean;
-/** Resolve a tmux pane id to its `session:window_index` — the target form
- *  `new-window -t` accepts. tmux REJECTS a pane id for new-window ("can't
- *  specify pane here"); only split-window -t takes a pane. null outside tmux /
- *  on a bad pane id / on error / empty. */
-export declare function paneWindowTarget(pane: string): string | null;
-/** The active pane of the user's attached tmux client — where they are looking
- *  right now. `list-clients` first attached client, then its current pane. Used
- *  to surface a human prompt in the user's view when nothing in the asking
- *  node's graph is focused. null outside tmux / no client / on error. */
-export declare function attachedClientPane(): string | null;
-/**
- * Schedule a kill-pane on the *current* tmux pane after `delaySeconds`, detached
- * so the caller can return normally before the pane dies. No-op outside tmux,
- * when TMUX_PANE is unset, or when delaySeconds <= 0.
- */
-export declare function scheduleKillCurrentPane(delaySeconds: number): boolean;
-export interface DetachOptions {
-    /** Inner command to run in the new pane. */
-    command: string;
-    cwd: string;
-    /** Optional id injected as the CRTR_JOB_ID env var in the pane. */
-    jobId?: string;
-    /** Where to open the new pane. */
-    placement: 'split-h' | 'split-v' | 'new-window';
-    /** Seconds before killing the originating pane so the caller can finish. */
-    killAfterSeconds: number;
-    /** Pin the new pane to this tmux pane: split-window splits it; new-window is
-     *  inserted immediately after its window (-a -t <pane>). Without this, tmux
-     *  uses the attached client's currently-focused pane — which drifts if the
-     *  user switches windows between kickoff and spawn. */
-    targetPane?: string;
-    /** Pass tmux `-d` to new-window so CREATING the window never switches the
-     *  attached client to it (split-window already leaves the client's view put).
-     *  The prompt lands in the target session/window without jumping the user out
-     *  of what they are looking at. No effect on split-h/split-v. */
-    detached?: boolean;
-}
-export interface DetachResult {
-    status: 'spawned' | 'spawn-failed' | 'not-in-tmux';
-    paneId?: string;
-    message: string;
-}
-/**
- * Fire-and-forget: launch `opts.command` in a new pane (or window), then
- * schedule the originating pane to be killed after `killAfterSeconds`. Returns
- * as soon as the new pane is up; does NOT wait for the command to finish.
- */
-export declare function spawnAndDetach(opts: DetachOptions): DetachResult;