@north-light/cli 0.0.0-stage → 0.3.413

package/dist/daemon/manage.d.ts

@@ -0,0 +1,176 @@
+import { type HealthDTO, type StartupPhaseDTO } from '../api/index.js';
+/** Env keys that must NEVER reach the daemon process. Restarting crtrd is
+ *  overwhelmingly done from inside an agent node's own bash tool (`crtr sys
+ *  daemon stop && start`), which inherits that node's FULL env — its identity
+ *  (`CRTR_NODE_ID`/`CRTR_KIND`/…, the `nodeEnv()` shape in `core/runtime/
+ *  nodes.ts`), its front-door recursion-guard flag, and any pi-engine
+ *  resolution seam a prior test/dev session left exported. The daemon is a
+ *  singleton supervisor, never "a node" itself, so none of this belongs in its
+ *  env regardless of whether today's code happens to read it — and at least one
+ *  of these IS actively read: `host.ts`'s broker-engine resolution falls back to
+ *  `envBrokerEngine()`'s raw `CRTR_BROKER_ENGINE` read verbatim (nodeEnv() never
+ *  sets that key, so nothing overrides it per child launch), so a daemon that inherits a
+ *  stale/dev override throws inside `headlessBrokerHost.launch()` on EVERY
+ *  relaunch it ever attempts, for its whole lifetime — the 2026-07-06 diagnosis
+ *  root cause behind 19 nodes killed with "failed to relaunch and is now dead". */
+export declare const DAEMON_ENV_STRIP_KEYS: readonly string[];
+/** A copy of `process.env` with every `DAEMON_ENV_STRIP_KEYS` entry removed.
+ *  Deliberate global config the user actually wants the daemon to see —
+ *  `CRTR_HOME`, `CRTR_SUBTREE`, `CRTR_LOG`, `CRTR_DEBUG`, etc. — passes through
+ *  untouched; only the node-identity/engine-poisoning surface is stripped. */
+export declare function sanitizedDaemonEnv(): NodeJS.ProcessEnv;
+/** A crtrd declares its owning canvas in argv, so ownership is an exact match
+ *  on this process's canvas home. Untagged daemons retain their own
+ *  supervision and are never counted or killed here. */
+export declare function daemonCommandDeclaresCanvasHome(command: string, home: string): boolean;
+/** Every crtrd process on this host that declares ownership of this process's
+ *  canvas home, by pid. The `daemon/crtrd` argv segment distinguishes daemons
+ *  from brokers. `ps` is best-effort: failures return no matches, and the
+ *  current process is always excluded. */
+export declare function findDaemonPids(): number[];
+/** SIGTERM (then SIGKILL after a short grace) every crtrd daemon process EXCEPT
+ *  `keepPid`. This is the backstop the pidfile alone cannot provide: a daemon
+ *  that survived a prior stop (ignored SIGTERM, or released its ownership lock
+ *  without exiting) keeps running a supervise loop — reviving brokers and
+ *  contending for canvas state — while never appearing in the pidfile again, so
+ *  `stop`'s single recorded-pid signal can never reach it. Returns the pids it
+ *  reaped. Best-effort throughout: a pid that dies between enumeration and signal
+ *  just no-ops. */
+export declare function sweepStrayDaemons(keepPid: number | null): number[];
+/** Replace PID 1 with the selected daemon generation. Docker keeps a container
+ *  alive only while PID 1 lives, so a handover there must preserve its pid. */
+export declare function execDaemon(): Promise<never>;
+export interface SpawnDaemonOptions {
+    /** The phase that proves a daemon launched by this call is available. */
+    targetPhase?: 'ready' | 'prepared';
+}
+export interface SpawnDaemonResult {
+    /** True when a new daemon process was spawned. */
+    started: boolean;
+    /** PID of the newly spawned process, if started. */
+    pid?: number;
+    /** PID of the already-running daemon, if it was already up. */
+    existing_pid?: number;
+    /** Present only when a live pidfile owner does not answer `/healthz`. */
+    running?: true;
+    /** Present with `running:true` when the Unix API socket is not serving. */
+    serving?: false;
+    /** The final `/healthz` probe failure when a live owner misses readiness. */
+    probe_error?: string;
+    /** The observed phase when the daemon was available. */
+    startup_phase?: StartupPhaseDTO;
+}
+/** Make one `/healthz` observation without client-side recovery. The caller owns the availability window, so this probe cannot extend it. */
+export declare function probeDaemonHealth(timeoutMs?: number): Promise<HealthDTO>;
+export declare function probeErrorMessage(error: unknown): string;
+/** True only when one mandatory Unix API socket probe answers the existing ready health contract. */
+export declare function probeDaemonServing(timeoutMs?: number): Promise<void>;
+/** True only when one mandatory Unix API socket probe answers `/healthz`.
+ * A pidfile identifies an owner; it is never readiness. */
+export declare function isDaemonServing(): Promise<boolean>;
+export interface DaemonWaitDeps {
+    readPidfile?: () => number | null;
+    isPidAlive?: (pid: number) => boolean;
+    sleepMs?: (ms: number) => Promise<void> | void;
+    now?: () => number;
+}
+export interface DaemonStartupDeps extends DaemonWaitDeps {
+    childExited?: () => {
+        code: number | null;
+        signal: NodeJS.Signals | null;
+    } | null;
+    /** What the exited child wrote to its error log, attached to the typed exit error. */
+    childStderrTail?: () => string;
+    isDaemonServing?: () => Promise<boolean>;
+    probeDaemonServing?: (timeoutMs: number) => Promise<void>;
+    probeDaemonHealth?: (timeoutMs: number) => Promise<HealthDTO>;
+}
+/** The spawned daemon process died before it ever became ready — a startup
+ *  failure, not a progressing migration (a live daemon never raises this).
+ *  `stderrTail` is what that run wrote to crtrd.err, so the CLI can say why. */
+export declare class DaemonExitedBeforeReadyError extends Error {
+    readonly stderrTail: string;
+    constructor(message: string, stderrTail: string);
+}
+/** A live daemon has bound its repair socket but cannot serve normal work
+ *  until its corpus migration succeeds. */
+export declare class DaemonStartupBlockedError extends Error {
+    constructor(pid: number, message: string);
+}
+/** A preparation request cannot succeed unless the live daemon explicitly reports prepared. */
+export declare class DaemonNotPreparedError extends Error {
+    constructor(pid: number, startupPhase: StartupPhaseDTO | undefined);
+}
+/** Tiny bounded post-spawn guard: wait for the daemon pidfile and live pid to
+ *  appear before reporting success. This catches the "started:true but not yet
+ *  plausibly alive" race without turning startup into a retry loop.
+ *
+ *  One deadline, owner-first polling. A signal or non-zero child exit fails
+ *  immediately. A clean code-0 exit is treated only as a possible ownership-
+ *  claim loser (never readiness on its own): polling continues on the SAME
+ *  deadline for a different live pidfile owner — the winner may publish its
+ *  pidfile deliberately late — and fails at that deadline if none appears. No
+ *  deadline extension and no retry spawn.
+ *
+ *  Returns null when the spawned pid owns the pidfile; returns a different live
+ *  daemon pid when startup lost the race to an already-running daemon. */
+export declare function verifyDaemonStartup(pid: number, timeoutMs?: number, deps?: DaemonStartupDeps, targetPhase?: 'ready' | 'prepared'): Promise<number | null>;
+/** Wait until a signaled daemon has exited and relinquished its pidfile. This
+ *  makes a following start safe to claim the singleton rather than racing its
+ *  previous owner. */
+export declare function waitForDaemonExit(pid: number, timeoutMs?: number, deps?: DaemonWaitDeps): Promise<void>;
+/** Stop the RECORDED daemon: SIGTERM, and if it does not exit within the wait
+ *  window, escalate to SIGKILL exactly as `sweepStrayDaemons` does for a stray.
+ *
+ *  The escalation is the point. Without it — SIGTERM, wait, throw on timeout,
+ *  never reaching the stray sweep — the one daemon `stop` is actually aimed at
+ *  would be the only crtrd process exempt from the SIGKILL backstop, and a
+ *  daemon whose shutdown hangs (or outruns the window) becomes permanently
+ *  unstoppable from the CLI: every retry re-sends a SIGTERM it is already
+ *  ignoring, and `start` keeps refusing as "already running".
+ *
+ *  A SIGKILL'd daemon runs no exit handler, so it leaves its pidfile behind
+ *  pointing at a dead pid. That is a stale record, not an owner: `readPidfile`
+ *  callers gate on `isPidAlive`, and the next `start` overwrites it. So this
+ *  waits on process death alone after a kill, never on pidfile release.
+ *
+ *  Returns how the daemon went down, for a truthful report. */
+export declare function stopDaemonProcess(pid: number, timeoutMs?: number, deps?: DaemonWaitDeps): Promise<'terminated' | 'killed'>;
+/** Spawn crtrd detached. Returns immediately; the child outlives this process.
+ *
+ *  If the daemon is already running, returns {started:false, existing_pid}.
+ *  If spawning fails (e.g. missing dist — run `npm run build` first), throws. */
+export declare function spawnDaemon(opts?: SpawnDaemonOptions): Promise<SpawnDaemonResult>;
+/** Whether autostart is suppressed for this invocation. `--no-autostart` or
+ *  `CRTR_NO_DAEMON_AUTOSTART=1` forces fail-loud on a cold socket (spec §7.1) —
+ *  for environments that manage crtrd externally and want the diagnostic, and
+ *  for test lanes, which point `CRTR_HOME` at a throwaway directory: an
+ *  autostarted daemon there is detached and resident, so it outlives both the
+ *  test process and the deleted temp home with nothing left to stop it.
+ *
+ *  This is the ONE gate. `ensureDaemon` below is the only path that spawns a
+ *  daemon implicitly, so the check belongs here rather than at each caller —
+ *  `cliClient()` reads it too, but the in-process spawn/recycle/promote callers
+ *  reach `ensureDaemon` without going through the CLI client at all. An
+ *  explicit `crtr sys daemon start` calls `spawnDaemon` directly and is
+ *  deliberately unaffected. */
+export declare function autostartDisabled(): boolean;
+/** Reset in-process spawn backoff after a daemon is observed alive. */
+export declare function resetDaemonAutostart(): void;
+export interface EnsureDaemonDeps {
+    isDaemonRunning?: () => boolean;
+    spawnDaemon?: () => Promise<SpawnDaemonResult>;
+    now?: () => number;
+}
+/** Why the daemon this process autostarted died before becoming ready, or
+ *  undefined while it is starting, running, or exited cleanly (a clean exit may
+ *  be a lost singleton race, so only a non-zero/signal exit counts). A client
+ *  waiting for that daemon polls this so a startup failure ends the wait now
+ *  rather than at the end of the startup window. */
+export declare function daemonAutostartStartupFailure(): string | undefined;
+/** Start the daemon if it is not already running. No-op if already up, if
+ *  autostart is suppressed for this invocation, while an attempt is in flight,
+ *  or while backing off from a recent failure.
+ *  Silently swallows spawn errors (the canvas still works without the daemon;
+ *  nodes just won't be auto-revived). */
+export declare function ensureDaemon(deps?: EnsureDaemonDeps): void;

package/dist/daemon/manage.js

@@ -0,0 +1,2 @@
+var z=Object.defineProperty;var o=(e,t)=>z(e,"name",{value:t,configurable:!0});import{spawn as Y,execFileSync as X}from"node:child_process";import{createRequire as V}from"node:module";import{dirname as b,join as E}from"node:path";import{fileURLToPath as q,pathToFileURL as M}from"node:url";import{existsSync as $,lstatSync as J,mkdirSync as Q,openSync as C,closeSync as F,fstatSync as B,readSync as Z}from"node:fs";import{crtrHome as x}from"../core/canvas/paths.js";import{listProcessTable as ee}from"../core/canvas/pid.js";import{bindDaemonEventSource as te,eventSource as re}from"../core/events/source.js";import{hostExecPath as U}from"../core/runtime/branded-host.js";import{isDaemonRunning as ne,readPidfile as g,isPidAlive as h}from"./pidfile.js";import{DAEMON_STARTUP_WINDOW_MS as W}from"./startup-policy.js";import{exclusiveLockOwnerPid as oe}from"../core/exclusive-lock.js";import{onDiskMigrationLockPath as ae}from"../core/canvas/paths.js";import{envNoDaemonAutostart as ie}from"../shared/env.js";import{waitForDaemonAvailability as se}from"../api/index.js";import{localClient as ce}from"../api/node-transport.js";const ue=["CRTR_NODE_ID","CRTR_KIND","CRTR_MODE","CRTR_LIFECYCLE","CRTR_NODE_CWD","CRTR_CONTEXT_DIR","CRTR_CYCLES","CRTR_PROFILE_ID","CRTR_PARENT_NODE_ID","CRTR_FRONT_DOOR","TMUX","TMUX_PANE","CRTR_BROKER_ENGINE","CRTR_PI_BINARY","NODE_OPTIONS"];function H(){const e={...process.env};for(const t of ue)delete e[t];return e}o(H,"sanitizedDaemonEnv");function le(){for(let e=b(q(import.meta.url));;e=b(e)){if($(E(e,"bin","runtime-generation-manifest.mjs")))return e;if(b(e)===e)throw new Error(`cannot locate the crouter generation root from ${import.meta.url}`)}}o(le,"generationRoot");async function K(){const e=le(),t=M(E(e,"bin","runtime-generation-manifest.mjs")).href,{runtimeHome:r}=await import(t);try{J(E(r(),"selected"))}catch(c){if(c.code!=="ENOENT")throw c;return["--conditions","crtr-src","--import",M(V(import.meta.url).resolve("tsx/esm")).href,E(e,"src","daemon","crtrd-cli.ts")]}const n=M(E(e,"bin","runtime-selector.mjs")).href,{tryResolveRuntime:a}=await import(n),s=a("daemon");if(!s.ok)throw new Error(`cannot resolve the selected runtime generation's daemon entry: ${s.error}`);return[s.runtime.entryPath]}o(K,"resolveDaemonLaunch");function de(e,t){return e.includes(` --canvas-home ${t} `)||e.endsWith(` --canvas-home ${t}`)}o(de,"daemonCommandDeclaresCanvasHome");function fe(){const e=ee();if(e===null)return[];const t=x(),r=[];for(const{pid:n,command:a}of e)a.includes("daemon/crtrd")&&de(a,t)&&n!==process.pid&&r.push(n);return r}o(fe,"findDaemonPids");function Ke(e){const t=fe().filter(n=>n!==e);for(const n of t)try{process.kill(n,"SIGTERM")}catch{}if(t.length===0)return t;const r=Date.now()+2e3;for(;Date.now()<r&&t.some(n=>h(n));)X("sleep",["0.1"]);for(const n of t)if(h(n))try{process.kill(n,"SIGKILL")}catch{}return t}o(Ke,"sweepStrayDaemons");async function Ge(){const e=process.execve;if(e===void 0)throw new Error(`this Node.js ${process.version} runtime cannot replace PID 1 with the successor daemon`);const t=U(),r=await K();return e(t,[t,...r,"--canvas-home",x()],H())}o(Ge,"execDaemon");const G=2e4,O=10,A=1e3;async function N(e=A){const t=Math.min(e,A);return ce({autostart:!1,timeoutMs:t}).probeHealthz(t)}o(N,"probeDaemonHealth");function pe(e){const t=e instanceof Error?e.message:String(e);if(typeof e!="object"||e===null)return t;const r=e.code,n=e.cause,a=typeof r=="string"?r:n?.code;return typeof a=="string"&&!t.includes(a)?`${t}: ${a}`:t}o(pe,"probeErrorMessage");async function j(e=A){const t=await N(e);if(t.startup_blocked!==void 0){const r=g()??process.pid;throw new S(r,t.startup_blocked)}if(!t.ok)throw new Error("crtrd health check reported not ready")}o(j,"probeDaemonServing");async function je(){try{return await j(),!0}catch{return!1}}o(je,"isDaemonServing");function P(e){return new Promise(t=>{setTimeout(t,e)})}o(P,"sleepMs");class I extends Error{static{o(this,"DaemonExitedBeforeReadyError")}stderrTail;constructor(t,r){super(r===""?t:`${t}
+${r}`),this.name="DaemonExitedBeforeReadyError",this.stderrTail=r}}class S extends Error{static{o(this,"DaemonStartupBlockedError")}constructor(t,r){super(`daemon ${t} is running but normal startup is blocked: ${r}`),this.name="DaemonStartupBlockedError"}}class k extends Error{static{o(this,"DaemonNotPreparedError")}constructor(t,r){super(r===void 0?`daemon ${t} is serving but did not report the prepared startup phase`:`daemon ${t} reported startup phase ${r}, not prepared`),this.name="DaemonNotPreparedError"}}async function me(e,t=W,r={},n="ready"){const a=r.readPidfile??g,s=r.isPidAlive??h,c=r.childExited,u=r.isDaemonServing,p=r.probeDaemonServing??(async w=>{if(u!==void 0){if(await u())return;throw new Error("crtrd health check reported not ready")}await j(w)}),D=r.probeDaemonHealth??N,y=r.sleepMs??P,i=r.now??Date.now;let f=null,l=null;return await se({windowMs:t,pollIntervalMs:O,now:i,sleep:y,retry:o(w=>w!==l,"retry"),probe:o(async w=>{const m=a();if(m===null||!s(m)){const d=c?.();throw d!=null&&(d.signal!==null?l=new I(`daemon ${e} exited before becoming ready (by ${d.signal})`,r.childStderrTail?.()??""):d.code!==0&&(l=new I(`daemon ${e} exited before becoming ready (with exit code ${d.code??"?"})`,r.childStderrTail?.()??"")),l!==null)?l:new Error(`daemon ${e} has no live pidfile owner`)}if(n==="ready"){try{await p(w)}catch(d){throw d instanceof S&&(l=d),d}f=m;return}const _=await D(w);if(_.startup_phase==="prepared"){f=m;return}throw _.startup_phase==="blocked"?(l=new S(m,_.startup_blocked??"on-disk migration is blocked"),l):_.startup_phase==="ready"?(l=new k(m,_.startup_phase),l):new Error(`daemon ${m} is ${_.startup_phase??"not reporting a startup phase"}; waiting for prepared`)},"probe")}),f===e?null:f}o(me,"verifyDaemonStartup");async function he(e,t=G,r={}){const n=r.readPidfile??g,a=r.isPidAlive??h,s=r.sleepMs??P,c=r.now??Date.now,u=c()+t;for(;c()<=u;){if(!a(e)&&n()!==e)return;await s(O)}throw new Error(`daemon ${e} did not exit and release its pidfile within ${t}ms`)}o(he,"waitForDaemonExit");const we=2e3,_e=5e3;async function Ee(e,t=G,r={}){const n=r.isPidAlive??h,a=r.sleepMs??P,s=r.now??Date.now;try{process.kill(e,"SIGTERM")}catch{}try{return await he(e,t,r),"terminated"}catch{}try{process.kill(e,"SIGKILL")}catch{}const c=s()+we;for(;s()<=c;){if(!n(e))return"killed";await a(O)}throw new Error(`daemon ${e} survived both SIGTERM and SIGKILL`)}o(Ee,"stopDaemonProcess");function De(e,t,r=2048){let n;try{n=C(e,"r");const{size:a}=B(n),s=Math.max(t,a-r),c=a-s;if(c<=0)return"";const u=Buffer.alloc(c);return Z(n,u,0,c,s),u.toString("utf8").trim()}catch{return""}finally{if(n!==void 0)try{F(n)}catch{}}}o(De,"readLogTailFrom");async function ye(e={}){if(process.platform==="linux"&&$("/run/crtr/launcher.sock")&&!h(g()??-1))throw new Error("crtrd is managed by the root launcher; it cannot self-daemonize");const t=e.targetPhase??"ready",r=g();if(r!==null&&h(r))try{const i=await N();if(t==="prepared"){if(i.startup_phase==="prepared")return{started:!1,existing_pid:r,startup_phase:i.startup_phase};throw new k(r,i.startup_phase)}return i.ok?{started:!1,existing_pid:r,...i.startup_phase===void 0?{}:{startup_phase:i.startup_phase}}:{started:!1,existing_pid:r,running:!0,serving:!1,probe_error:i.startup_blocked??"crtrd health check reported not ready",...i.startup_phase===void 0?{}:{startup_phase:i.startup_phase}}}catch(i){if(i instanceof k)throw i;return{started:!1,existing_pid:r,running:!0,serving:!1,probe_error:pe(i)}}Q(x(),{recursive:!0});const n=await K(),a=E(x(),"crtrd.err"),s=C(a,"a"),c=(()=>{try{return B(s).size}catch{return 0}})();re()===void 0&&te();const u=Y(U(),[...n,"--canvas-home",x(),...t==="prepared"?["--prepare"]:[]],{detached:!0,stdio:["ignore",s,s],env:H()});F(s);const p=u.pid;if(p===void 0)throw new Error("daemon spawn did not return a pid");let D=null;u.once("exit",(i,f)=>{D={code:i,signal:f}}),u.unref();let y;try{y=await me(p,W,{childExited:o(()=>D,"childExited"),childStderrTail:o(()=>De(a,c),"childStderrTail")},t)}catch(i){const f=oe(ae())===p;if(D===null&&!f&&!(i instanceof S))try{await Ee(p,_e)}catch{}throw i}return y!==null?{started:!1,existing_pid:y,startup_phase:t}:{started:!0,pid:p,startup_phase:t}}o(ye,"spawnDaemon");function xe(){return ie()||process.argv.includes("--no-autostart")}o(xe,"autostartDisabled");const ge=5e3,Re=6e4;let L=!1,R,v=0,T=0;function Se(e){return Math.min(ge*2**(e-1),Re)}o(Se,"autostartBackoffMs");function ve(){R=void 0,v=0,T=0}o(ve,"resetDaemonAutostart");function ze(){return R}o(ze,"daemonAutostartStartupFailure");function Ye(e={}){const t=e.isDaemonRunning??ne,r=e.spawnDaemon??ye,n=e.now??Date.now;if(!xe()&&!L&&!(n()<T)){if(t()){ve();return}R=void 0,L=!0,r().then(()=>{R=void 0,v=0,T=0},a=>{a instanceof I&&(R=a.message),v+=1,T=n()+Se(v)}).finally(()=>{L=!1})}}o(Ye,"ensureDaemon");export{ue as DAEMON_ENV_STRIP_KEYS,I as DaemonExitedBeforeReadyError,k as DaemonNotPreparedError,S as DaemonStartupBlockedError,xe as autostartDisabled,ze as daemonAutostartStartupFailure,de as daemonCommandDeclaresCanvasHome,Ye as ensureDaemon,Ge as execDaemon,fe as findDaemonPids,je as isDaemonServing,N as probeDaemonHealth,j as probeDaemonServing,pe as probeErrorMessage,ve as resetDaemonAutostart,H as sanitizedDaemonEnv,ye as spawnDaemon,Ee as stopDaemonProcess,Ke as sweepStrayDaemons,me as verifyDaemonStartup,he as waitForDaemonExit};

package/dist/daemon/messaging/node-message.d.ts

@@ -0,0 +1,27 @@
+export type NodeMessageMode = 'interactive' | 'wake' | 'quiet';
+export interface NodeMessageDelivery {
+    entry_id: string | null;
+    via: 'engine' | 'inbox';
+    revived: boolean;
+    reason?: 'capacity_frozen';
+}
+export interface RuntimeMessageCard {
+    /** A bare core kind only. This renders with `formatCard`, which leaves the
+     *  body raw — a namespaced kind's body is decoded on read (D12) and would be
+     *  corrupted. Extend the union rather than widening to `string`. */
+    kind: 'review-comment' | 'review-queued' | 'review-approval';
+    facts: Record<string, string | number | boolean | undefined>;
+}
+/**
+ * Deliver one daemon-originated node message. Interactive messages use the live
+ * broker when available; every other successful path is durable node mail.
+ */
+export declare function deliverNodeMessage(args: {
+    node_id: string;
+    body: string;
+    label: string;
+    from?: string | null;
+    mode: NodeMessageMode;
+    data?: Record<string, unknown>;
+    runtime?: RuntimeMessageCard;
+}): Promise<NodeMessageDelivery>;

package/dist/daemon/messaging/node-message.js

@@ -0,0 +1 @@
+var a=Object.defineProperty;var r=(e,i)=>a(e,"name",{value:i,configurable:!0});import{getNode as l}from"../../core/canvas/canvas.js";import{cancelCronsOnWake as c}from"../../core/canvas/crons.js";import{withFreshTerminalGuard as _}from"../../core/canvas/canvas.js";import{emitEvent as s}from"../../core/events/emit.js";import{enqueueNodeMail as y}from"../../core/feed/messages.js";import{BrokerUnreachableError as p}from"../../core/runtime/broker-request.js";import{deliverLive as v}from"../../core/runtime/interactive-deliver.js";import{isBrokerLive as u}from"../../core/runtime/model-swap.js";import{reviveNode as b}from"../../core/runtime/revive.js";import{hasNoNaturalCycle as h}from"../../core/runtime/revive-all.js";import{ReviewOperationError as k}from"../../core/review/types.js";import{formatCard as w}from"../../shared/generated-context.js";import{isProfilePaused as N}from"../../core/profiles/manifest.js";function d(e,i){throw new k("delivery_unroutable",i==="origin_missing"?"message target was not found":"message target has no natural delivery cycle",{node_id:e,reason:i})}r(d,"deliveryUnroutable");function m(e,i){const n=_(e,h,i);return n.kind==="missing"&&d(e,"origin_missing"),n.kind==="terminal"&&d(e,"no_natural_cycle"),n.result}r(m,"guardRoutable");async function G(e){m(e.node_id,()=>{});let i=l(e.node_id);if(i===null&&d(e.node_id,"origin_missing"),e.mode==="interactive"&&!i.run_id&&!N(i.profile_id)&&u(i))try{return await v(e.node_id,e.runtime===void 0?e.body:w(e.runtime.kind,e.runtime.facts,e.body),{origin:e.from==="human"?{type:"human"}:{type:"runtime",kind:"inbox",entries:[{...e.from==null?{}:{from:e.from},kind:"message",tier:"normal"}]}}),m(e.node_id,()=>{}),c(e.node_id),{entry_id:null,via:"engine",revived:!1}}catch(o){if(!(o instanceof p))throw o}const n=m(e.node_id,()=>y(e.node_id,{senderNodeId:e.from??null,kind:"message",label:e.label,bodyJson:{...e.data,body:e.body},urgency:e.mode==="quiet"?"deferred":"normal",wake:1}));let f=!1,t;if(n.urgency!=="deferred"&&(i=l(e.node_id),i===null&&d(e.node_id,"origin_missing"),!u(i)))try{const o=await b(e.node_id,{resume:!0,capacity:"freeze"});f=o.launch!==void 0,o.outcome==="frozen"&&(t="capacity_frozen")}catch(o){s({level:"error",event:"message.wake_failed",node_id:e.node_id,error:o,fields:{message_id:n.messageId}})}return{entry_id:n.messageId,via:"inbox",revived:f,...t===void 0?{}:{reason:t}}}r(G,"deliverNodeMessage");export{G as deliverNodeMessage};

package/dist/daemon/park-activity.d.ts

@@ -0,0 +1,9 @@
+import type { NodeMeta } from '../core/canvas/types.js';
+import type { PendingPark } from './park-pending.js';
+/** A main-session write after parking was armed is durable evidence of live
+ * input even when the turn has since settled and the viewer detached. */
+export declare function mainSessionActivitySince(sessionFile: string | null | undefined, startedAt: number): boolean;
+/** One verdict shared by normal completion and grace expiry. A broker records
+ * accepted live input against the process-local marker before it drives Pi, so
+ * the verdict cannot race a viewer, live delivery, or durable wake. */
+export declare function shouldParkAfterSummary(nodeId: string, node: Pick<NodeMeta, 'lifecycle' | 'pi_session_file'>, pending: PendingPark): boolean;

package/dist/daemon/park-activity.js

@@ -0,0 +1 @@
+var a=Object.defineProperty;var i=(r,t)=>a(r,"name",{value:t,configurable:!0});import{conversationIdFromPath as n,conversationStore as f,ConversationNotFoundError as u}from"../core/conversation-store/index.js";import{emitEvent as m}from"../core/events/emit.js";import{hasWakeMailSince as c}from"../core/canvas/deliveries.js";import{readLiveTurn as s}from"../core/canvas/recovery.js";import{parkEvent as l}from"./reconcilers/live-obligation.js";function v(r,t){if(r==null)return!1;const e=n(r);if(e===null)return!1;try{return f().header(e).mtime>=t}catch(o){return o instanceof u?!1:(m({level:"warn",event:"broker.park.session_activity_scan_failed",error:o}),!0)}}i(v,"mainSessionActivitySince");function d(r,t,e){return!e.activity&&s(r)?.busy!==!0&&!v(t.pi_session_file,e.startedAt)&&!c(r,e.startedAt)&&l(r,t.lifecycle)==="park"}i(d,"shouldParkAfterSummary");export{v as mainSessionActivitySince,d as shouldParkAfterSummary};

package/dist/daemon/park-pending.d.ts

@@ -0,0 +1,18 @@
+export type PendingPark = {
+    startedAt: number;
+    activity: boolean;
+};
+/** Arm a pending park for `nodeId`. The caller delivers the parking prompt. */
+export declare function beginPendingPark(nodeId: string, now: number): void;
+/** Record main-engine input accepted while the isolated turn is in flight. */
+export declare function recordPendingParkActivity(nodeId: string): boolean;
+export declare function isPendingPark(nodeId: string): boolean;
+/** When the pending park was armed, or undefined when none is armed. */
+export declare function pendingParkStartedAt(nodeId: string): number | undefined;
+/** Delete-and-report the pending marker. Both the supervision tick and the
+ * settle handler run on the daemon thread with no await between their check and
+ * this call, so exactly one of them ever enacts a given park. */
+export declare function consumePendingPark(nodeId: string): PendingPark | undefined;
+/** Every node with a parking turn in flight — the reconciler's sweep drops the
+ *  ones whose broker has left the fleet. */
+export declare function pendingParkIds(): string[];

package/dist/daemon/park-pending.js

@@ -0,0 +1 @@
+var i=Object.defineProperty;var n=(e,t)=>i(e,"name",{value:t,configurable:!0});const r=new Map;function o(e,t){r.set(e,{startedAt:t,activity:!1})}n(o,"beginPendingPark");function u(e){const t=r.get(e);return t===void 0?!1:(t.activity=!0,!0)}n(u,"recordPendingParkActivity");function d(e){return r.has(e)}n(d,"isPendingPark");function c(e){return r.get(e)?.startedAt}n(c,"pendingParkStartedAt");function f(e){const t=r.get(e);return t!==void 0&&r.delete(e),t}n(f,"consumePendingPark");function s(){return Array.from(r.keys())}n(s,"pendingParkIds");export{o as beginPendingPark,f as consumePendingPark,d as isPendingPark,s as pendingParkIds,c as pendingParkStartedAt,u as recordPendingParkActivity};

package/dist/daemon/pidfile.d.ts

@@ -0,0 +1,8 @@
+import { isPidAlive } from '../core/canvas/pid.js';
+export { isPidAlive };
+/** Absolute path to crtrd's pidfile. `CRTR_PIDFILE` overrides for tests. */
+export declare function pidfilePath(): string;
+/** Read the pid stored in the pidfile, or null if absent / malformed. */
+export declare function readPidfile(): number | null;
+/** True when a crtrd process is already running (pidfile exists + pid alive). */
+export declare function isDaemonRunning(): boolean;

package/dist/daemon/pidfile.js

@@ -0,0 +1 @@
+var o=Object.defineProperty;var i=(r,n)=>o(r,"name",{value:n,configurable:!0});import{existsSync as m,readFileSync as u}from"node:fs";import{join as f}from"node:path";import{crtrHome as p}from"../core/canvas/paths.js";import{isPidAlive as e}from"../core/canvas/pid.js";import{envPidfileOverride as c}from"../shared/env.js";function l(){return c()??f(p(),"crtrd.pid")}i(l,"pidfilePath");function d(){const r=l();if(!m(r))return null;const n=u(r,"utf8").trim(),t=Number(n);return Number.isFinite(t)&&t>0?t:null}i(d,"readPidfile");function y(){const r=d();return r!==null&&e(r)}i(y,"isDaemonRunning");export{y as isDaemonRunning,e as isPidAlive,l as pidfilePath,d as readPidfile};

package/dist/daemon/profile-delete.d.ts

@@ -0,0 +1,7 @@
+import type { DeleteProfileResultDTO } from '../api/index.js';
+/** Validate and enact one forced profile deletion. A request from a node that
+ *  belongs to the target profile is acknowledged before its broker is stopped. */
+export declare function requestProfileDeletion(name: string, body: unknown): Promise<{
+    status: 200 | 202;
+    body: DeleteProfileResultDTO;
+}>;

package/dist/daemon/profile-delete.js

@@ -0,0 +1 @@
+var q=Object.defineProperty;var d=(e,r)=>q(e,"name",{value:r,configurable:!0});import{existsSync as p,readFileSync as E,readdirSync as y,rmSync as h}from"node:fs";import{join as a}from"node:path";import{cronIdsForProfileDeletion as R,cronIdsForProfileDetach as C,deleteCronsForProfile as T,deleteNodes as O,getNode as m,getRow as W,globalizeCronsForProfile as M,listNodesByProfile as B,nodesRoot as $,reviewDir as z}from"../core/canvas/index.js";import{withCanvasWrite as v}from"../core/canvas/db.js";import{deleteProfileWithOwned as _}from"../core/graph/deletion.js";import{usage as u}from"../core/errors.js";import{emitEvent as A}from"../core/events/emit.js";import{clearDefaultProfileId as k,defaultProfileDirs as L}from"../core/profiles/default-binding.js";import{reserveProfileDeletion as J}from"../core/profiles/deletion-reservation.js";import{deleteProfile as D,loadProfileManifest as G}from"../core/profiles/manifest.js";import{deleteReviewsByOriginNodes as H,reviewIdsByOriginNodes as K}from"../core/review/store.js";import{boundFleet as U}from"../core/runtime/fleet.js";import{headlessBrokerHost as b}from"../core/runtime/host.js";import{transition as Q}from"../core/runtime/lifecycle.js";import{tearDownNode as V}from"../core/runtime/placement.js";import{reshapeNode as X}from"../core/runtime/promote.js";import{reviveNode as Y}from"../core/runtime/revive.js";const P=1e3,N=new Set(["page.json","page.tsx","page.html","page.js","review.json","response.json","progress.json","claim.json","reply-route.json","feedback-comments.json","feedback.json",".ticket-lock"]),I=new Map;function Z(e){if(typeof e!="object"||e===null||Array.isArray(e))throw u("profile deletion requires a JSON request body",{error:"force_required",message:"profile deletion requires --force",next:"Re-run `crtr profile delete <profile> --force` after reviewing its effects."});return e}d(Z,"requestObject");function ee(e){const r=Z(e);if(r.force!==!0)throw u("profile deletion requires --force",{error:"force_required",message:"profile deletion requires --force",next:"Re-run `crtr profile delete <profile> --force` after reviewing its effects."});if(r.detach!==void 0&&typeof r.detach!="boolean")throw u("detach must be a boolean",{error:"invalid_detach",message:"detach must be a boolean",next:"Use --detach as a presence-only flag, or omit it."});const t=r.caller_node_id;if(t!=null&&(typeof t!="string"||t===""))throw u("caller_node_id must be a nonempty string or null");return{force:!0,...r.detach===!0?{detach:!0}:{},...t===void 0?{}:{caller_node_id:t}}}d(ee,"validateRequest");function j(e){if(!p(e))return null;try{const r=JSON.parse(E(e,"utf8"));return typeof r.source?.nodeId=="string"&&r.source.nodeId!==""?r.source.nodeId:null}catch{return null}}d(j,"manifestSourceNodeId");function re(e){const r=new Set(e),t=$();if(r.size===0||!p(t))return[];const o=[];for(const n of y(t,{withFileTypes:!0})){if(!n.isDirectory())continue;const s=a(t,n.name);[j(a(s,"page.json")),j(a(s,"review.json"))].some(l=>l!==null&&r.has(l))&&o.push({dir:s,wholeDirectory:r.has(n.name)||W(n.name)===null})}return o.sort((n,s)=>n.dir.localeCompare(s.dir))}d(re,"ticketCleanupForNodes");function te(e){if(N.has(e))return!0;for(const r of N)if(e.startsWith(`${r}.`)&&(e.endsWith(".tmp")||e.endsWith(".lock")))return!0;return!1}d(te,"isTicketOwnedResidue");function oe(e){let r=0;for(const t of e)if(p(t.dir)){if(t.wholeDirectory){h(t.dir,{recursive:!0,force:!0}),r+=1;continue}for(const o of y(t.dir,{withFileTypes:!0}))te(o.name)&&h(a(t.dir,o.name),{recursive:!0,force:!0});r+=1}return r}d(oe,"cleanTickets");function S(e){const r=e.filter(o=>o.managed_worktree?.state==="open").map(o=>({node_id:o.node_id,path:o.managed_worktree.path}));if(r.length===0)return null;const t=`profile deletion is blocked by ${r.length} open managed worktree${r.length===1?"":"s"}`;return u(t,{error:"open_managed_worktree",message:t,nodes:r,next:`Close ${r.map(({node_id:o})=>o).join(", ")} with \`crtr node worktree close <node>\`, then retry.`})}d(S,"openWorktreeError");function ne(e,r){const t=B(e.profileId),o=S(t);if(o!==null)throw o;const n=t.map(({node_id:c})=>c),s=r.detach===!0?"detached":"deleted";return{entry:e,mode:s,nodes:t,nodeIds:n,tickets:s==="deleted"?re(n):[],cronIds:s==="deleted"?R(e.profileId,n):C(e.profileId),reviewIds:s==="deleted"?K(n):[],defaultDirs:L(e.profileId)}}d(ne,"prepareDeletion");function x(e){const r=e.nodeIds.flatMap(o=>{const n=m(o);return n===null?[]:[n]}),t=S(r);if(t!==null)throw t}d(x,"assertDeletionPlanPreconditions");function g(e){return{profile_id:e.entry.profileId,name:e.entry.manifest.name,mode:e.mode,nodes:e.nodeIds.length,crons:e.cronIds.length,tickets:e.tickets.length,reviews:e.reviewIds.length,default_pins:e.defaultDirs.length}}d(g,"resultForPlan");async function ie(e){x(e);const r=e.nodeIds.filter(i=>m(i)!==null),t=U(),o=r.flatMap(i=>{const f=t.get(i);return f===void 0?[]:[{nodeId:i,exited:f.handle.exited}]}),n=[];for(const{nodeId:i}of o){const f=m(i);(f?.status==="active"||f?.status==="idle")&&(Q(i,"release"),n.push(i)),b.teardown(i)}await Promise.all(o.map(({exited:i})=>i));const s=[];for(const i of r)m(i)!==null&&(X(i,{profileId:null}),s.push(i));const c=M(e.entry.profileId),l=k(e.entry.profileId);v(i=>_(i,e.entry.profileId)),D(e.entry.profileId);const w=new Set(s);for(const i of n)w.has(i)&&await Y(i,{resume:!0,recovery:!0,capacity:"freeze"});return{...g(e),nodes:s.length,crons:c.length,default_pins:l.length}}d(ie,"detachProfile");function se(e){x(e);const r=T(e.entry.profileId,e.nodeIds);for(const c of e.nodeIds)b.teardown(c),V(c);const t=H(e.nodeIds);for(const c of t)h(z(c),{recursive:!0,force:!0});const o=oe(e.tickets),n=O(e.nodeIds),s=k(e.entry.profileId);return v(c=>_(c,e.entry.profileId)),D(e.entry.profileId),{...g(e),nodes:n.length,crons:r.length,tickets:o,reviews:t.length,default_pins:s.length}}d(se,"hardDeleteProfile");async function F(e){return e.mode==="detached"?ie(e):se(e)}d(F,"executePlan");function de(e,r){const t={...g(e),accepted:!0,grace_ms:P};return I.set(e.entry.profileId,{result:t}),setTimeout(()=>{(async()=>{try{await F(e)}catch(o){A({level:"error",event:"profile.delete.deferred_failed",error:o instanceof Error?o:new Error(String(o)),fields:{profile_id:e.entry.profileId,mode:e.mode}})}finally{I.delete(e.entry.profileId),r()}})()},P),t}d(de,"scheduleSelfDeletion");async function Ne(e,r){const t=ee(r),o=G(e),n=I.get(o.profileId);if(n!==void 0)return{status:202,body:n.result};const s=J(o.profileId);let c=!1;try{const l=ne(o,t);if(t.caller_node_id!=null&&l.nodeIds.includes(t.caller_node_id)){const i=de(l,s);return c=!0,{status:202,body:i}}return{status:200,body:await F(l)}}finally{c||s()}}d(Ne,"requestProfileDeletion");export{Ne as requestProfileDeletion};

package/dist/daemon/reconcilers/action-lane.d.ts

@@ -0,0 +1,8 @@
+import type { DetachedWorkLifecycle } from './broker-supervision.js';
+export interface ActionLaneContext {
+    lifecycle: DetachedWorkLifecycle;
+}
+/** The daemon lane for one-shot obligations with no publishing object: cron spawn/human sinks and human completion actions. */
+export declare class ActionLaneReconciler {
+    run(now: number, ctx: ActionLaneContext): void;
+}

package/dist/daemon/reconcilers/action-lane.js

@@ -0,0 +1 @@
+var p=Object.defineProperty;var s=(n,r)=>p(n,"name",{value:r,configurable:!0});import{rmSync as h}from"node:fs";import{claimDaemonAction as y,dueDaemonActions as g,settleDaemonAction as I}from"../../core/canvas/daemon-actions.js";import{getNode as _}from"../../core/canvas/canvas.js";import{emitEvent as l}from"../../core/events/emit.js";import{operationIdContext as c}from"../../core/events/operation-id.js";import{createPageRequest as v,getRequest as u}from"../../core/human/requests.js";import{synthesizedPageDocument as w,writeSynthesizedPage as k}from"../../core/human/page-synth.js";import{preparePage as $}from"../../core/human/page-authoring.js";import{resolvePageComponents as q}from"../../core/config.js";import{spawnChild as b}from"../../core/runtime/spawn.js";import{runDelivery as D}from"../delivery/run-delivery.js";import{deliveryDaemonInstanceId as f}from"./delivery-lane.js";function d(n,r,e){I(n.actionId,n.attempts,r,e,Date.now())}s(d,"settle");function a(n,r,e){d(n,r,{state:"permanent_failed",failure:{kind:"spawn_error",message:e}})}s(a,"failed");async function N(n,r,e){const t=_(e.nodeId);if(t!==null){if(t.frozen_at!==null||t.pi_session_id!==null||t.status==="idle"||t.status==="done"||t.status==="canceled"){d(n,r,{state:"acknowledged"});return}a(n,r,t.status==="dead"?`cron spawn ${e.nodeId} recorded a failed birth`:`cron spawn ${e.nodeId} found an incomplete birth`);return}try{await b({nodeId:e.nodeId,kind:e.kind,cwd:e.cwd,prompt:e.prompt,...e.root?{root:!0,rootLifecycle:e.rootLifecycle}:{parent:e.parent},readiness:"launch",profile:e.profile,isolated:e.isolated===!0,wakeOrigin:e.wakeOrigin}),d(n,r,{state:"acknowledged"})}catch(o){a(n,r,`cron spawn ${e.nodeId} failed: ${o instanceof Error?o.message:String(o)}`),c.fresh(()=>l({level:"error",event:"delivery.cron_spawn_failed",node_id:e.nodeId,error:o,fields:{action_id:n.actionId}}))}}s(N,"deliverSpawn");function P(n,r){const e=k(w(n.title,n.summary,r,!1));try{return $({sourceFile:e.path,source:{sessionName:n.sessionName,...n.profileName===null?{}:{profileName:n.profileName}},productKinds:q(),delivery:{placement:"inline",inbox:!0,reply:!1}})}finally{h(e.dir,{recursive:!0,force:!0})}}s(P,"preparedCronPage");function S(n,r,e){if(u(e.requestId)!==null){d(n,r,{state:"acknowledged"});return}const t=n.body,o=typeof t?.stdout=="string"?t.stdout:null;if(o===null){a(n,r,`cron human ${e.requestId} has no frozen stdout`);return}try{v({request_id:e.requestId,prepared:P(e,o)}),d(n,r,{state:"acknowledged"})}catch(i){a(n,r,`cron human ${e.requestId} failed: ${i instanceof Error?i.message:String(i)}`)}}s(S,"deliverHuman");async function z(n,r){const e=n.adapter;if(n.body===null){a(n,r,`daemon action ${n.actionId} has no body`);return}if(e.adapter==="subprocess"){let t=e.node_id;if(t===void 0){const o=n.idempotencyKey;if(!o.startsWith("human-action:"))throw new Error(`daemon action ${n.actionId} has no originating app`);const i=u(o.slice(13));if(!i)throw new Error(`daemon action ${n.actionId} has no originating human request`);t=i.requester_node_id}await D({argv:e.argv,cwd:e.cwd,document:n.body,attempt:n.attempts,nodeId:t,...e.app?{app:e.app}:{}},o=>d(n,r,o));return}if(e.adapter==="cron_spawn"){await N(n,r,e);return}if(e.adapter==="cron_human"){S(n,r,e);return}a(n,r,`daemon action ${n.actionId} has unknown adapter ${String(e.adapter)}`)}s(z,"deliverAction");class G{static{s(this,"ActionLaneReconciler")}run(r,e){if(!e.lifecycle.acceptsDetachedWork())return;let t;try{t=g(r)}catch(o){c.fresh(()=>l({level:"error",event:"daemon_action.scan_failed",error:o}));return}for(const o of t)try{const i=y(o.actionId,r,f);if(i===null)continue;e.lifecycle.registerDetached(z(i,f).catch(m=>{c.fresh(()=>l({level:"error",event:"daemon_action.failed",error:m,fields:{action_id:i.actionId}}))}))}catch(i){c.fresh(()=>l({level:"error",event:"daemon_action.claim_failed",error:i,fields:{action_id:o.actionId}}))}}}export{G as ActionLaneReconciler};

package/dist/daemon/reconcilers/bash-deadline.d.ts

@@ -0,0 +1,27 @@
+import type { NodeRow } from '../../core/canvas/index.js';
+export interface BashDeadlineContext {
+    rows: NodeRow[];
+}
+/** Cancel AUTO-backgrounded bash jobs whose claim-or-cancel deadline has passed.
+ *
+ * The valve backgrounds a command it could not finish waiting for and arms a
+ * deadline the owning node must extend (`crtr node bash extend`) to keep the job
+ * alive. This lane is the enforcer: it survives a broker restart and fires while
+ * the node is idle, so a runaway command cannot outlive its window just because
+ * the agent moved on. A deliberately backgrounded job carries no deadline and is
+ * never canceled here. It also publishes every backgrounded job's exit, and adopts
+ * a job the broker backgrounded while exiting (SIGTERM/SIGHUP), which could not
+ * record its own job object. */
+export declare class BashDeadlineReconciler {
+    private lastScanAt;
+    /** An exit written before this daemon started is history, not a job to adopt. */
+    private readonly startedAt;
+    run(now: number, ctx: BashDeadlineContext): Promise<void>;
+    /** A running job whose supervisor wrote job.exit has exited: `finishJob` publishes `exited`
+     *  once (the row leaves `running`). A job being stopped (job.stop) is ended by its killer. */
+    private publishExits;
+    /** Give every backgrounded job dir (job.bg) that has no job object one; the next tick's
+     *  `publishExits` then ends it like any other job. */
+    private adoptUnrecorded;
+    private cancel;
+}

package/dist/daemon/reconcilers/bash-deadline.js

@@ -0,0 +1,2 @@
+var p=Object.defineProperty;var f=(l,e)=>p(l,"name",{value:e,configurable:!0});import{prepared as u}from"../../core/sqlite-statements.js";import{existsSync as s,readFileSync as m,readdirSync as j,statSync as _}from"node:fs";import{join as b}from"node:path";import{bashJobPaths as S,bashJobsDir as x,expiredAutoBackgroundBashJobs as y,stopBackgroundBashJob as N}from"../../core/bash-jobs.js";import{killBashJobObject as E,recordBashJobObject as v}from"../../core/spaces/stop.js";import{withCanvasWrite as h}from"../../core/canvas/db.js";import{finishJob as g}from"../../core/graph/jobs.js";import{getById as A,getByRowid as B}from"../../core/graph/objects.js";import{isSafeNodeId as c}from"../../core/canvas/paths.js";import{contextDir as J}from"../../core/canvas/node-agent-paths.js";import{emitEvent as a}from"../../core/events/emit.js";import{operationIdContext as d}from"../../core/events/operation-id.js";import{isProfilePaused as w}from"../../core/profiles/manifest.js";const D=5*1e3;class H{static{f(this,"BashDeadlineReconciler")}lastScanAt=Number.NEGATIVE_INFINITY;startedAt=Date.now();async run(e,n){if(this.publishExits(),!(e-this.lastScanAt<D)){this.lastScanAt=e;for(const t of n.rows){if(t.status==="dead"||w(t.profile_id))continue;const i=J(t.node_id);let r;try{this.adoptUnrecorded(t.node_id,i),r=y(i,e)}catch(o){d.fresh(()=>{a({level:"error",event:"bash_deadline.scan_failed",...c(t.node_id)?{node_id:t.node_id}:{},error:o})});continue}for(const o of r)await this.cancel(t.node_id,i,o.jobId)}}}publishExits(){try{h(e=>{const n=u(e,`SELECT j.object, j.job_dir FROM jobs j JOIN objects o ON o.rowid = j.object
+          WHERE j.status = 'running' AND o.deleted_at IS NULL`).all();for(const{object:t,job_dir:i}of n){const r=b(i,"job.exit");if(!s(r)||s(b(i,"job.stop")))continue;const o=Number(m(r,"utf8").trim());Number.isSafeInteger(o)&&g(e,B(e,t),{exitCode:o})}})}catch(e){d.fresh(()=>a({level:"error",event:"bash_completion.delivery_failed",error:e}))}}adoptUnrecorded(e,n){let t;try{t=j(x(n))}catch{return}const i=h(r=>t.filter(o=>A(r,o)===null));for(const r of i){const o=S(n,r);!s(o.jobBg)||!s(o.cmdSh)||s(o.jobExit)&&_(o.jobExit).mtimeMs<this.startedAt||v(e,r,{command:m(o.cmdSh,"utf8"),jobDir:o.dir,logPath:o.jobLog})}}async cancel(e,n,t){(await N(n,t,!1,e)).kind==="stopped"&&d.fresh(()=>{try{a({level:"info",event:"bash_deadline.canceled",...c(e)?{node_id:e}:{},fields:{job_id:t}}),E(t,()=>null,"deadline")}catch(r){a({level:"error",event:"bash_deadline.notice_failed",...c(e)?{node_id:e}:{},error:r,fields:{job_id:t}})}})}}export{H as BashDeadlineReconciler};

package/dist/daemon/reconcilers/broker-supervision.d.ts

@@ -0,0 +1,88 @@
+import { type NodeRow } from '../../core/canvas/index.js';
+import { type FleetRegistry } from '../../core/runtime/fleet.js';
+export interface DetachedWorkLifecycle {
+    acceptsDetachedWork(): boolean;
+    registerDetached(work: Promise<void>): void;
+}
+export interface BrokerSupervisionContext {
+    /** The rows the tick loaded — supervision walks these and looks each one's
+     *  fleet entry up, rather than re-reading a row per live entry. */
+    rows: readonly NodeRow[];
+    fleet: FleetRegistry;
+    lifecycle: DetachedWorkLifecycle;
+}
+type TreeSample = {
+    cpuPercent: number;
+    hasDescendants: boolean;
+} | null;
+export interface BrokerSupervisionOptions {
+    readTreeSample?: (pid: number) => Promise<TreeSample>;
+    signal?: (pid: number, signal: NodeJS.Signals) => void | Promise<void>;
+}
+export interface SaturationContext {
+    fleet: FleetRegistry;
+    lifecycle: DetachedWorkLifecycle;
+    thresholds: {
+        warning: number;
+        automaticReviveCap: number;
+    };
+    /** What the freeze lane left frozen this tick, split into rows that stalled
+     *  and rows waiting on mail. */
+    frozen: {
+        stalled: number;
+        waitingOnMail: number;
+    };
+}
+export declare const YIELD_STALL_GRACE_MS: number;
+export declare const WEDGE_QUIET_MS: number;
+export declare const WEDGE_CPU_MAX_PERCENT = 2;
+export declare function unattendedParkMsForDaemon(): number;
+export declare function parkSummaryGraceMsForDaemon(): number;
+export type WedgeVerdict = 'leave' | 'pending' | 'wedged';
+export declare function yieldStallVerdict(piPidAlive: boolean | null, intent: NodeRow['intent'], busy: boolean, stalledFor: number | null): 'leave' | 'pending' | 'kill';
+export declare function wedgeVerdict(input: {
+    busy: boolean;
+    quietForMs: number | null;
+    cpuPercent: number | null;
+    hasDescendants: boolean | null;
+}): WedgeVerdict;
+export declare function sumTreeCpu(psOutput: string, rootPid: number): number | null;
+export declare function treeHasDescendants(psOutput: string, rootPid: number): boolean | null;
+export declare class BrokerSupervisionReconciler {
+    private readonly yieldStalls;
+    private readonly wedgeNotifiedAt;
+    private readonly fatalFaultNotifiedAt;
+    private readonly unattendedSince;
+    private readonly sampleTree;
+    private readonly signal;
+    private lastOverCapWarnAt;
+    constructor(options?: BrokerSupervisionOptions);
+    /** The fleet-wide preamble, run BEFORE the tick's row-list guard: the thresholds
+     *  it returns are read once for the whole tick. There is no credential-reload fan:
+     *  the daemon owns credentials and a broker's `reload_auth` handler only acks, so
+     *  fanning it on every provider-store revision was dead work. */
+    runFleetPreamble(_fleet: FleetRegistry): Promise<{
+        warning: number;
+        automaticReviveCap: number;
+    }>;
+    /** The saturation notice, run LAST in the tick: the frozen split it reports
+     *  is only known once the freeze lane has spent this tick's free slots. */
+    warnIfSaturated(ctx: SaturationContext): void;
+    run(now: number, ctx: BrokerSupervisionContext): Promise<void>;
+    /** Every condition that resets the unattended clock EXCEPT `isBusy` — the
+     *  node is unavailable to park, attended, or has work waiting. Short-circuits
+     *  in cost order so the common tick does no file reads it can avoid. */
+    private parkResetCondition;
+    private handleUnattendedParking;
+    /** Deliver the parking prompt over the live broker's serialized frame loop.
+     * An unreachable broker falls through to degraded parking; either prompt route
+     * starts the same isolated turn, so a concurrent main turn stays passive. */
+    private requestParkSummary;
+    private warnOverCapInTmux;
+    private handleYieldStall;
+    private signalYieldStall;
+    private readTreeSample;
+    private handleWedgeDetection;
+    private handleFatalFault;
+}
+export {};

package/dist/daemon/reconcilers/broker-supervision.js

@@ -0,0 +1,4 @@
+var q=Object.defineProperty;var p=(l,e)=>q(l,"name",{value:e,configurable:!0});import{existsSync as Y}from"node:fs";import{LAUNCHER_SOCKET as H}from"../../launcher/spec.js";import{launcherRequest as K}from"../../launcher/client.js";import{execFile as V}from"node:child_process";import{promisify as z}from"node:util";import{getNode as N,isWarmSpare as j}from"../../core/canvas/index.js";import{isSafeNodeId as u}from"../../core/canvas/paths.js";import{contextDir as J}from"../../core/canvas/node-agent-paths.js";import{fullName as I}from"../../core/canvas/labels.js";import{recordedPidLiveness as D}from"../../core/canvas/pid.js";import{transition as Q}from"../../core/runtime/lifecycle.js";import{readFault as R,readLiveTurn as E,recordFault as X}from"../../core/canvas/recovery.js";import{errorClassFromFault as Z}from"../../core/fault-classifier.js";import{nextFaultRetry as ee}from"../../core/runtime/fault-recovery.js";import{publishNotice as x}from"../../core/runtime/close.js";import{headlessBrokerHost as k}from"../../core/runtime/host.js";import{emitEvent as f}from"../../core/events/emit.js";import{operationIdContext as O}from"../../core/events/operation-id.js";import{hasUnseenWakeMail as te,resetStaleExecutionMail as ne}from"../../core/canvas/deliveries.js";import{activeBackgroundBashJobs as re}from"../../core/bash-jobs.js";import{focusOf as ie}from"../../core/runtime/placement.js";import{hasAttachedBrokerViewers as ae}from"../api/viewer-presence.js";import{deliverLive as se}from"../../core/runtime/interactive-deliver.js";import{BrokerUnreachableError as le}from"../../core/runtime/broker-request.js";import{formatCard as oe,PARK_SUMMARY_PROMPT as de}from"../../shared/generated-context.js";import{brokerThresholdsForDaemon as ue}from"../../core/runtime/fleet.js";import{readConfig as ce}from"../../core/config.js";import{beginPendingPark as fe,consumePendingPark as y,pendingParkIds as pe,pendingParkStartedAt as me}from"../park-pending.js";import{shouldParkAfterSummary as he}from"../park-activity.js";import{applyParkEvent as b,parkEvent as _e}from"./live-obligation.js";import{envNoDaemonAutostart as ge,envTestUnattendedParkMs as ke,parkSummaryGraceMs as ve,envUnattendedParkMs as ye}from"../../shared/env.js";const A=z(V);function be(l){return E(l)?.busy===!0}p(be,"liveBusy");function lt(l){const e=E(l)?.progressAt;if(e==null)return null;const t=Date.parse(e);return Number.isNaN(t)?null:t}p(lt,"liveTurnProgressMs");function L(l,e){return e===null?null:`${l}:${e}`}p(L,"incarnationOf");function F(l){const e=E(l.node_id),t=e?.busy===!0&&e.progressAt!==null?Date.parse(e.progressAt):Number.NaN,a=l.launched_at===null||l.launched_at===void 0?Number.NaN:Date.parse(l.launched_at);return!Number.isFinite(t)||!Number.isFinite(a)||t<a?null:t}p(F,"busySinceForIncarnation");const G=3*6e4,W=2e4,C=20*6e4,we=2,Se=5*6e4;function Ne(){const l=ye();if(l!==void 0)return l;const e=ce("user").lifecycle.unattendedParkMs;return ge()?ke()??e:e}p(Ne,"unattendedParkMsForDaemon");function U(){return ve()}p(U,"parkSummaryGraceMsForDaemon");function Ae(l,e,t,a){return l!==!0||e!=="refresh"||t?"leave":a===null||a<G?"pending":"kill"}p(Ae,"yieldStallVerdict");function Pe(l){return!l.busy||l.quietForMs===null||l.quietForMs<C?"leave":l.cpuPercent===null||l.hasDescendants!==!1&&l.cpuPercent>we?"pending":"wedged"}p(Pe,"wedgeVerdict");function B(l){const e=new Map,t=new Map;for(const a of l.split(`
+`)){const i=a.trim();if(i==="")continue;const n=i.split(/\s+/);if(n.length<3)continue;const s=Number(n[0]),r=Number(n[1]),o=Number(n[2]);if(!Number.isFinite(s)||!Number.isFinite(r)||!Number.isFinite(o))continue;e.set(s,o);const c=t.get(r);c===void 0?t.set(r,[s]):c.push(s)}return{byPid:e,childrenOf:t}}p(B,"parsePsTree");function $e(l,e){const{byPid:t,childrenOf:a}=B(l);if(!t.has(e))return null;let i=0;const n=[e],s=new Set;for(;n.length>0;){const r=n.pop();if(s.has(r))continue;s.add(r),i+=t.get(r)??0;const o=a.get(r);o!==void 0&&n.push(...o)}return i}p($e,"sumTreeCpu");function Me(l,e){const{byPid:t,childrenOf:a}=B(l);return t.has(e)?(a.get(e)??[]).length>0:null}p(Me,"treeHasDescendants");class ot{static{p(this,"BrokerSupervisionReconciler")}yieldStalls=new Map;wedgeNotifiedAt=new Map;fatalFaultNotifiedAt=new Map;unattendedSince=new Map;sampleTree;signal;lastOverCapWarnAt=Number.NEGATIVE_INFINITY;constructor(e={}){this.sampleTree=e.readTreeSample??(t=>this.readTreeSample(t)),this.signal=e.signal??((t,a)=>{if(process.platform==="linux"&&Y(H)){if(a!=="SIGTERM"&&a!=="SIGKILL")throw new Error(`unsupported launcher signal ${a}`);return K({operation:"stop",pid:t,signal:a}).then(()=>{})}process.kill(t,a)})}async runFleetPreamble(e){return ue()}warnIfSaturated(e){if(e.fleet.size()<e.thresholds.warning||!e.lifecycle.acceptsDetachedWork())return;const t=O.fresh(()=>this.warnOverCapInTmux(e.fleet.size(),e.thresholds,e.frozen));e.lifecycle.registerDetached(t)}async run(e,t){const a=Ne();for(const i of t.rows){const n=i.node_id,s=t.fleet.get(n);if(s===void 0||i.status!=="active"&&i.status!=="idle"){this.unattendedSince.delete(n);continue}await O.fresh(async()=>{try{await this.handleYieldStall(i,s,t.fleet,e),await this.handleWedgeDetection(i,s,t.fleet,e),this.handleFatalFault(n),this.handleUnattendedParking(n,N(n),s.pid,e,t,a)}catch(r){this.unattendedSince.delete(n),f({level:"error",event:"broker.supervision.failed",...u(n)?{node_id:n}:{fields:{affected_node_id:n}},error:r})}})}for(const i of this.unattendedSince.keys())t.fleet.has(i)||this.unattendedSince.delete(i);for(const i of pe())t.fleet.has(i)||y(i);ne(e)}parkResetCondition(e,t,a,i){if(t.pi_session_id==null||t.pi_pid!==a||t.status==="done"||t.status==="canceled"||t.status==="dead"||t.intent!==null||re(J(e)).length>0||ie(e)!==null||ae(e))return!0;const n=R(e);return n!==null&&n.retry.disposition==="auto"&&n.retry.by==="daemon"&&(n.kind==="connection"||n.kind==="rate-limit"||n.kind==="overloaded")&&(n.retry.nextAt!==void 0||ee(n,i)!==null)?!0:te(e)}handleUnattendedParking(e,t,a,i,n,s){if(j(e)){this.unattendedSince.delete(e),y(e);return}if(t===null){this.unattendedSince.delete(e),y(e);return}const r=this.parkResetCondition(e,t,a,i),o=me(e);if(o!==void 0){if(i-o<U())return;const m=y(e);if(m===void 0||(this.unattendedSince.delete(e),!he(e,t,m)))return;f({level:"warn",event:"broker.park.summary_expired",...u(e)?{node_id:e}:{},fields:{...u(e)?{}:{affected_node_id:e},grace_ms:U()}}),b(e,"park"),k.teardown(e);return}if(r||be(e)){this.unattendedSince.delete(e);return}const c=this.unattendedSince.get(e);if(c===void 0){this.unattendedSince.set(e,i);return}if(i-c<s)return;this.unattendedSince.delete(e);const d=_e(e,t.lifecycle);if(d==="release"){b(e,d),k.teardown(e);return}if(d==="cancel"){b(e,d),k.teardown(e);return}if(t.grantee!==void 0&&t.grantee!=="app:terminal"){b(e,"park"),k.teardown(e);return}n.lifecycle.acceptsDetachedWork()&&(fe(e,i),n.lifecycle.registerDetached(this.requestParkSummary(e)))}async requestParkSummary(e){try{const t=await se(e,oe("park",{},de),{origin:{type:"runtime",kind:"park"}});f({level:"info",event:"broker.park.summary_requested",...u(e)?{node_id:e}:{},fields:{...u(e)?{}:{affected_node_id:e},route:t}})}catch(t){if(y(e)===void 0)return;if(t instanceof le){b(e,"park"),k.teardown(e);return}f({level:"error",event:"broker.park.summary_failed",...u(e)?{node_id:e}:{fields:{affected_node_id:e}},error:t})}}async warnOverCapInTmux(e,t,a){const i=Date.now();if(i-this.lastOverCapWarnAt<Se)return;this.lastOverCapWarnAt=i;const{warning:n,automaticReviveCap:s}=t,r=a.stalled+a.waitingOnMail;f({level:"warn",event:"broker.capacity.warning",fields:{live_count:e,warning_threshold:n,hard_cap:s,frozen_stalled:a.stalled,frozen_waiting_on_mail:a.waitingOnMail}});const o=r===0?"":` \u2014 ${r} frozen (${a.stalled} stalled, ${a.waitingOnMail} waiting on mail)`,c=`\u26A0 crtrd: ${e} live brokers (warning ${n}; hard cap ${s})${o} \u2014 possible broker leak. ps -ax | grep broker-cli.js`;try{const d=await A("tmux",["list-clients","-F","#{client_name}"],{encoding:"utf8",timeout:2e3});if(typeof d.stdout!="string")return;await Promise.allSettled(d.stdout.split(`
+`).map(async m=>{if(m!=="")try{await A("tmux",["display-message","-C","-d","10000","-c",m,c],{encoding:"utf8",timeout:2e3})}catch{try{await A("tmux",["display-message","-c",m,c],{encoding:"utf8",timeout:2e3})}catch(h){f({level:"error",event:"broker.capacity.tmux_display_failed",error:h,fields:{client:m}})}}}))}catch(d){f({level:"error",event:"broker.capacity.tmux_list_clients_failed",error:d})}}async handleYieldStall(e,t,a,i){const n=e.node_id,s=L(t.pid,e.pi_pid_identity);if(e.intent!=="refresh"||F(e)!==null||s===null){s!==null&&this.yieldStalls.delete(s);return}let r=this.yieldStalls.get(s);if(r===void 0){r={since:i},this.yieldStalls.set(s,r);return}if(Ae(!0,e.intent,!1,i-r.since)!=="kill")return;const o=N(n);if(!(a.get(n)!==t||o?.pi_pid!==t.pid||o.pi_pid_identity!==e.pi_pid_identity||D(t.pid,e.pi_pid_identity)!=="alive"))if(r.termedAt===void 0){if(!await this.signalYieldStall(n,t.pid,"SIGTERM"))return;r.termedAt=i,f({level:"warn",event:"broker.yield_stall.sigterm",...u(n)?{node_id:n}:{},fields:{...u(n)?{}:{affected_node_id:n},pid:t.pid,elapsed_ms:i-r.since,grace_ms:G}})}else i-r.termedAt>=W&&await this.signalYieldStall(n,t.pid,"SIGKILL")&&f({level:"warn",event:"broker.yield_stall.sigkill",...u(n)?{node_id:n}:{},fields:{...u(n)?{}:{affected_node_id:n},pid:t.pid,elapsed_ms:i-r.termedAt,grace_ms:W,stall_elapsed_ms:i-r.since}})}async signalYieldStall(e,t,a){try{return await this.signal(t,a),!0}catch(i){return f({level:"error",event:"broker.yield_stall.signal_failed",...u(e)?{node_id:e}:{},error:i,fields:{...u(e)?{}:{affected_node_id:e},pid:t,signal:a}}),!1}}async readTreeSample(e){try{const{stdout:t}=await A("ps",["-ax","-o","pid=,ppid=,pcpu="],{encoding:"utf8",timeout:2e3});if(typeof t!="string")return null;const a=$e(t,e),i=Me(t,e);return a===null||i===null?null:{cpuPercent:a,hasDescendants:i}}catch{return null}}async handleWedgeDetection(e,t,a,i){const n=e.node_id,s=L(t.pid,e.pi_pid_identity),r=F(e);if(r===null||s===null){s!==null&&this.wedgeNotifiedAt.delete(s);return}const o=i-r,c=o>=C?await this.sampleTree(t.pid):null,d=N(n),m=d===null?null:F(d);if(a.get(n)!==t||d===null||d.pi_pid!==t.pid||d.pi_pid_identity!==e.pi_pid_identity||m!==r)return;const h=c?.cpuPercent??null,_=c?.hasDescendants??null;if(Pe({busy:!0,quietForMs:o,cpuPercent:h,hasDescendants:_})!=="wedged"||this.wedgeNotifiedAt.get(s)===r)return;this.wedgeNotifiedAt.set(s,r);const w=I(d),S=Math.round((o??C)/6e4),P=_??!0,v=!P&&D(t.pid,e.pi_pid_identity)!=="alive"?"pid_identity_unproven":null;let $=!1,M=!1,g;if(P)g=`Child wedged \u2014 ${w} (${n}) is alive and mid-turn but has shown NO engine progress for ${S}+ minutes and its process is near-idle. It will NOT recover on its own \u2014 read \`crtr canvas read wedged-child-on-runaway-bash\` and kill the runaway SUBPROCESS (not this node) so its turn can resume with no lost context.`;else if(v!==null)g=`Child wedged \u2014 ${w} (${n}) is alive and mid-turn but has shown NO engine progress for ${S}+ minutes and it has no subprocess to kill (the engine itself stalled). The daemon did not SIGTERM the broker because its PID identity cannot be confirmed alive.`;else{$=!0;try{await this.signal(t.pid,"SIGTERM"),M=!0,g=`Child wedged \u2014 ${w} (${n}) is alive and mid-turn but has shown NO engine progress for ${S}+ minutes and it has no subprocess to kill (the engine itself stalled). The daemon sent SIGTERM to the broker and will resume a cleanly aborted session with a continuation, or start a recovery cycle if the abort cannot settle.`}catch(T){f({level:"error",event:"broker.wedge.signal_failed",...u(n)?{node_id:n}:{},error:T,fields:{...u(n)?{}:{affected_node_id:n},pid:t.pid,signal:"SIGTERM"}}),g=`Child wedged \u2014 ${w} (${n}) is alive and mid-turn but has shown NO engine progress for ${S}+ minutes and it has no subprocess to kill (the engine itself stalled). The daemon attempted SIGTERM to the broker, but the signal call failed.`}}f({level:"error",event:"broker.wedge.detected",...u(n)?{node_id:n}:{},fields:{...u(n)?{}:{affected_node_id:n},pid:t.pid,quiet_ms:o,cpu_percent:h,has_descendants:P,kick_attempted:$,kicked:M,...v===null?{}:{kick_suppression_reason:v}}});try{X(n,{link:"daemon\u2192node",op:"engine wedge",kind:"wedged",retry:{disposition:"manual"},message:g})}catch(T){f({level:"error",event:"broker.wedge.fault_record_failed",...u(n)?{node_id:n}:{fields:{affected_node_id:n}},error:T})}x(n,"notice.crash",g,{reason:"child-wedged",child:n,quiet_ms:o,cpu_percent:h,kick_attempted:$,kicked:M,...v===null?{}:{kick_suppression_reason:v}})}handleFatalFault(e){const t=R(e);if(t===null){this.fatalFaultNotifiedAt.delete(e);return}if(t.retry.disposition!=="fatal"||t.link!=="pi\u2192provider"||this.fatalFaultNotifiedAt.get(e)===t.since)return;const a=N(e),i=a!==null?I(a):e,n=t.kind==="auth",s=(t.message.split(`
+`)[0]??"").slice(0,200),r=t.providerError,o=r===void 0?"":` Provider: ${r.provider}/${r.model}.`+(r.status===void 0?"":` HTTP status: ${r.status}.`)+(r.errno===void 0?"":` Errno: ${r.errno}.`)+(r.code===void 0?"":` Code: ${r.code}.`)+(r.body===void 0?"":` Body: ${r.body.slice(0,200)}.`)+(r.ratelimit===void 0?"":` Rate limit: ${r.ratelimit.scope??"account"}${r.ratelimit.claim===void 0?"":` (${r.ratelimit.claim})`}${r.ratelimit.model===void 0?"":` on ${r.ratelimit.model}`}.`),c=t.kind==="context-overflow",d=a?.parent==null&&a?.lifecycle==="terminal",m=c||d,h=c?`Child failed \u2014 ${i} (${e}) exceeded its model context window and is now dead. Shrink the task or loaded context, or choose a larger-context model before spawning it again. Error: ${s}`:`Child hit a fatal provider fault \u2014 ${i} (${e}) got a non-retryable ${t.kind} error and will NOT recover on its own; `+(d?"its terminal run has failed. ":"it stays alive, and waking it clears the fault as soon as one turn completes \u2014 a wake that hits the same cause fails again. "+(n?"Its provider credential is dead \u2014 re-authenticate (`/login`, or re-auth crtr); the child recovers on its next wake once the auth reloads. ":""))+`Error: ${s}.${o}`;m&&(Q(e,"crash",{reason:c?"context_overflow":"provider_fatal",outcome:{detail:{schema:"crtr.node-outcome-detail/v1",message:t.message,fault_kind:t.kind,error_class:Z(t).class}}}),k.teardown(e).then(_=>{_.confirmed||f({level:"error",event:"fault.fatal.teardown_failed",node_id:e,error:_.error??new Error("Broker teardown not confirmed")})},_=>f({level:"error",event:"fault.fatal.teardown_failed",node_id:e,error:_}))),this.fatalFaultNotifiedAt.set(e,t.since),f({level:"error",event:"fault.fatal.fanout",...u(e)?{node_id:e}:{},fields:{...u(e)?{}:{affected_node_id:e},kind:t.kind,link:t.link,terminal_overflow:c,terminal_provider_fault:d}}),x(e,"notice.crash",h,{reason:c?"child-context-overflow":"child-fault-fatal",child:e,kind:t.kind,message:s,...r===void 0?{}:{provider_error:r}})}}export{ot as BrokerSupervisionReconciler,we as WEDGE_CPU_MAX_PERCENT,C as WEDGE_QUIET_MS,G as YIELD_STALL_GRACE_MS,U as parkSummaryGraceMsForDaemon,$e as sumTreeCpu,Me as treeHasDescendants,Ne as unattendedParkMsForDaemon,Pe as wedgeVerdict,Ae as yieldStallVerdict};

package/dist/daemon/reconcilers/controller-death.d.ts

@@ -0,0 +1,7 @@
+import { type NodeRow } from '../../core/canvas/index.js';
+export interface ControllerDeathContext {
+    rows: readonly NodeRow[];
+}
+export declare class ControllerDeathReconciler {
+    run(now: number, ctx: ControllerDeathContext): void;
+}

package/dist/daemon/reconcilers/controller-death.js

@@ -0,0 +1 @@
+var l=Object.defineProperty;var t=(r,o)=>l(r,"name",{value:o,configurable:!0});import{liveControllerWaits as n}from"../../core/canvas/waits.js";import{operationIdContext as a}from"../../core/events/operation-id.js";import{enqueueControllerDeathNotice as c}from"../../core/feed/messages.js";class s{static{t(this,"ControllerDeathReconciler")}run(o,i){for(const e of n())a.fresh(()=>{c(e.nodeId,e.controllerId)})}}export{s as ControllerDeathReconciler};

package/dist/daemon/reconcilers/cron-lane.d.ts

@@ -0,0 +1,7 @@
+import type { DetachedWorkLifecycle } from './broker-supervision.js';
+export interface CronLaneContext {
+    lifecycle: DetachedWorkLifecycle;
+}
+export declare class CronLaneReconciler {
+    run(now: number, ctx: CronLaneContext): void;
+}

package/dist/daemon/reconcilers/cron-lane.js

@@ -0,0 +1 @@
+var l=Object.defineProperty;var t=(c,r)=>l(c,"name",{value:r,configurable:!0});import{emitEvent as i}from"../../core/events/emit.js";import{operationIdContext as n}from"../../core/events/operation-id.js";import{recoverStaleCronLeases as a,runDueCrons as s}from"../cron-run.js";class h{static{t(this,"CronLaneReconciler")}run(r,o){if(n.fresh(()=>{try{a(r,{register:t(e=>o.lifecycle.registerDetached(e),"register")})}catch(e){i({level:"error",event:"cron.lease_recovery.failed",error:e})}}),!!o.lifecycle.acceptsDetachedWork())try{s(r,{register:t(e=>o.lifecycle.registerDetached(e),"register")})}catch(e){i({level:"error",event:"cron.run.failed",error:e})}}}export{h as CronLaneReconciler};

package/dist/daemon/reconcilers/delivery-lane.d.ts

@@ -0,0 +1,9 @@
+import type { DetachedWorkLifecycle } from './broker-supervision.js';
+export declare const deliveryDaemonInstanceId: `${string}-${string}-${string}-${string}-${string}`;
+export interface DeliveryLaneContext {
+    lifecycle: DetachedWorkLifecycle;
+}
+/** Due push receivers only. Queue rows have no next_attempt_at and never enter this lane. */
+export declare class DeliveryLaneReconciler {
+    run(now: number, ctx: DeliveryLaneContext): void;
+}

package/dist/daemon/reconcilers/delivery-lane.js

@@ -0,0 +1,8 @@
+var h=Object.defineProperty;var p=(e,t)=>h(e,"name",{value:t,configurable:!0});import{prepared as D}from"../../core/sqlite-statements.js";import{randomUUID as w}from"node:crypto";import{claimPushDelivery as j,duePushDeliveries as N,messageBodyForDelivery as O,pushDeliveryClaimIsCurrent as b,settleDelivery as d}from"../../core/canvas/deliveries.js";import{deliveryBackoffMs as f}from"../../core/canvas/delivery-contract.js";import{openDb as c}from"../../core/canvas/db.js";import{pushLineFor as u}from"../../core/graph/custom.js";import{postReceiverUrl as E}from"../../core/graph/receiver-url.js";import{emitEvent as l}from"../../core/events/emit.js";import{operationIdContext as m}from"../../core/events/operation-id.js";import{runDelivery as v,DELIVERY_TIMEOUT_MS as T}from"../delivery/run-delivery.js";const I=w();function o(e,t,r){d(e.deliveryId,e.attempts,t,{state:"permanent_failed",failure:{kind:"spawn_error",message:r}},Date.now())}p(o,"failed");async function A(e,t){const r=D(c(),`SELECT o.type, o.name, c.receiver_json, c.payload_json, m.object_id, i.external_id AS app,
+    d.message_id, owner.type AS owner_type, parent.external_id AS parent_app
+    FROM deliveries d JOIN objects o ON o.id = d.destination_id
+    JOIN custom_objects c ON c.object = o.rowid JOIN messages m ON m.message_id = d.message_id
+    LEFT JOIN objects owner ON owner.rowid = o.owner
+    LEFT JOIN identities i ON i.object = o.owner AND i.scheme = 'app'
+    LEFT JOIN identities parent ON parent.object = owner.owner AND parent.scheme = 'app'
+    WHERE d.delivery_id = ?`).get(e.deliveryId);if(!r||!r.receiver_json){o(e,t,`delivery ${e.deliveryId} has no supported receiver`);return}const i=JSON.parse(r.receiver_json);if(!b(e,t)){d(e.deliveryId,e.attempts,t,{state:"acknowledged"},Date.now());return}if(typeof i=="object"&&typeof i.url=="string"&&r.type!=="action"){const n=u(c(),e.deliveryId);if(!n){o(e,t,`delivery ${e.deliveryId} has no event document`);return}try{const a=await E(i.url,JSON.stringify(n),{"Content-Type":"application/json","X-Crtr-Delivery":e.deliveryId,"X-Crtr-Event":r.message_id},T);a>=200&&a<300?d(e.deliveryId,e.attempts,t,{state:"acknowledged"},Date.now()):a>=300&&a<400?o(e,t,`url receiver returned HTTP ${a}; redirects are not followed \u2014 register the final URL`):a>=400&&a<500&&a!==408&&a!==429?o(e,t,`url receiver returned HTTP ${a}`):d(e.deliveryId,e.attempts,t,{state:"pending",nextAttemptAt:Date.now()+f(e.attempts),failure:{kind:"spawn_error",message:`url receiver returned HTTP ${a}`}},Date.now())}catch(a){d(e.deliveryId,e.attempts,t,{state:"pending",nextAttemptAt:Date.now()+f(e.attempts),failure:{kind:"spawn_error",message:String(a)}},Date.now())}return}if(typeof i!="object"||!Array.isArray(i.argv)||typeof i.cwd!="string"){o(e,t,`delivery ${e.deliveryId} has an invalid argv receiver`);return}if(r.type==="action"){if(typeof i.name!="string"||!r.object_id){o(e,t,`delivery ${e.deliveryId} has an invalid argv receiver`);return}const n=O(e.deliveryId);if(n===null){o(e,t,`delivery ${e.deliveryId} has no message body`);return}const{push:a,...y}=n,_={...y,action:{name:i.name,payload:r.payload_json===null?null:JSON.parse(r.payload_json)}};await v({argv:i.argv,cwd:i.cwd,document:_,attempt:e.attempts,nodeId:r.object_id,...r.app?{app:r.app}:{}},g=>{d(e.deliveryId,e.attempts,t,g,Date.now())});return}const s=u(c(),e.deliveryId);if(!s){o(e,t,`delivery ${e.deliveryId} has no event document`);return}await v({argv:i.argv,cwd:i.cwd,document:s,attempt:e.attempts,app:r.app??r.parent_app??"app:terminal",custom:{deliveryId:e.deliveryId,messageId:r.message_id}},n=>{d(e.deliveryId,e.attempts,t,n,Date.now())})}p(A,"deliverExternal");class H{static{p(this,"DeliveryLaneReconciler")}run(t,r){if(!r.lifecycle.acceptsDetachedWork())return;let i;try{i=N(t)}catch(s){m.fresh(()=>l({level:"error",event:"delivery.scan_failed",error:s}));return}for(const s of i)try{const n=j(s.deliveryId,t,I);if(n===null)continue;r.lifecycle.registerDetached(A(n,I).catch(a=>{m.fresh(()=>l({level:"error",event:"delivery.failed",error:a,fields:{delivery_id:n.deliveryId}}))}))}catch(n){m.fresh(()=>l({level:"error",event:"delivery.claim_failed",error:n,fields:{delivery_id:s.deliveryId}}))}}}export{H as DeliveryLaneReconciler,I as deliveryDaemonInstanceId};

package/dist/daemon/reconcilers/fault-retry-backstop.d.ts

@@ -0,0 +1,41 @@
+import { type PendingProviderRetry } from '../../core/canvas/recovery.js';
+import type { FleetRegistry } from '../../core/runtime/fleet.js';
+import type { DetachedWorkLifecycle } from './broker-supervision.js';
+/** How long past its due time a pending retry may sit before the daemon
+ *  concludes the broker's timer is gone. A live timer fires at the due time and
+ *  finishes within seconds (network probe 3s, rewind, one admit mutation), and
+ *  the connection ladder caps its delay at 60s, so two minutes clears every
+ *  in-flight attempt, a tick of jitter, and a broker waking from system sleep,
+ *  while still resuming a stranded node without a person noticing the wait. It
+ *  doubles as the minimum gap between two nudges of the same fault. */
+export declare const FAULT_RETRY_STALE_GRACE_MS: number;
+/** The reconciler scans at most this often: its probe is a network call and a
+ *  stranded retry is not urgent to the second. */
+export declare const FAULT_RETRY_SCAN_INTERVAL_MS = 15000;
+export interface FaultRetryBackstopContext {
+    fleet: Pick<FleetRegistry, 'has'>;
+    lifecycle: DetachedWorkLifecycle;
+}
+export interface FaultRetryBackstopDeps {
+    probeOnline?: () => Promise<boolean>;
+    /** Signal a node's broker; false when it holds no open signal stream. */
+    nudge?: (nodeId: string) => boolean;
+    list?: () => PendingProviderRetry[];
+    busy?: (nodeId: string) => boolean;
+}
+/** When the broker's timer should have fired: the recorded next attempt, else
+ *  the policy delay after the fault was last (re)recorded as pending. */
+export declare function dueAtMs(pending: PendingProviderRetry): number | null;
+export declare class FaultRetryBackstopReconciler {
+    private readonly deps;
+    private lastScanAt;
+    private scanning;
+    /** fault id → when the daemon last nudged it. Pruned to current candidates. */
+    private readonly nudgedAt;
+    constructor(deps?: FaultRetryBackstopDeps);
+    /** Starts a detached scan (throttled, never overlapping). The returned promise
+     *  settles with that scan so a caller that wants to observe it can; the tick
+     *  does not await it. */
+    run(now: number, ctx: FaultRetryBackstopContext): Promise<void>;
+    private scan;
+}