@north-light/cli 0.0.0 → 0.3.414

package/dist/core/canvas/nav-model.d.ts

@@ -0,0 +1,44 @@
+import { type FlatRow, type FoldState, type SubtreeActivity } from './nav-render.js';
+import type { NodeMeta } from './index.js';
+export { PI_MAX_WIDGET_LINES, VIEWPORT_FALLBACK_ROWS, ESC, RESET, BOLD, DIM, REVERSE, BG_ATTACHED, GREEN, RED, YELLOW, CYAN, GRAY, nodeGlyph, visibleWidth, truncate, fillWidth, fillBar, fmtTokens, tokensCell, activityCell, cycleBadge, navLabel, shortId, askBadge, liveBelowBadge, isAttached, hasBrokerViewers, fetchAsksMap, graphWidgetBudget, GRAPH_HINT, type FlatRow, type FoldState, type SubtreeActivity, } from './nav-render.js';
+/** First manager (by created) — the UP step for the ancestry spine. */
+export declare function managerOf(id: string): string | undefined;
+/** A kind:'human' node is a control-plane ASK (a page on the human's
+ *  screen), NOT a pi conversation — it has no session, so focusing/reviving it
+ *  boots a confused blank "you have been revived" pi. Its pending-ask signal
+ *  already rides the ⚑ badge on the ASKING node (attention.ts follows the
+ *  bridge node's parent relation), so the row carries no signal of its
+ *  own. Drop it from every navigable list (the tree, BASE reports, child counts,
+ *  subtree expansion) so it can never be selected. */
+export declare function isHumanAsk(id: string): boolean;
+/** A node's direct children that are navigable conversations — human-ask nodes
+ *  dropped. The one place the nav chrome enumerates children. */
+export declare function convoChildIds(id: string): string[];
+/** Live reports (active|idle) of a node — the DOWN set in BASE. */
+export declare function liveReports(id: string): string[];
+/** Direct navigable children — used for the ⤳ badge (human-ask nodes excluded,
+ *  so the count matches what the tree actually shows). */
+export declare function childCount(id: string): number;
+/** Climb first-manager edges from `self` to the ancestry root (cycle-guarded). */
+export declare function climbRoot(self: string): string;
+/** Space-joined ids of a node's subtree (cursor-relative {subtree} var). */
+export declare function subtreeIds(root: string): string[];
+/** ⤳M direct-children badge — the single child-count signal, shown on any row
+ *  with navigable children (folded or not). In GRAPH the ▸ caret separately marks
+ *  a collapsed row, so this stays a pure count and never doubles as a fold badge. */
+export declare function childBadge(node: NodeMeta | null): string;
+/** Direct children, live-first — the sibling order used both when flattening
+ *  the tree and when stepping into a subtree (`l`). Array.sort is stable, so
+ *  equal-status siblings keep their creation order. */
+export declare function sortedChildIds(id: string): string[];
+export declare function computeSubtreeActivity(root: string, self: string): SubtreeActivity;
+/** Fold policy alone — thin wrapper over computeSubtreeActivity for the keypress
+ *  path (buildGraphModel without a precomputed set). The render path computes the
+ *  activity once and threads `expand` in, so it never recomputes here. */
+export declare function computeDefaultExpanded(root: string, self: string): Set<string>;
+export declare function buildGraphModel(self: string, folds: FoldState, expand?: ReadonlySet<string>): FlatRow[];
+/** Render one GRAPH row. CURSOR (selected) → reverse-video bar; an ATTACHED
+ *  (human-watched) node → a coloured background bar; SELF → bold name. The
+ *  cursor outranks the attached tint when both land on the same row. The
+ *  overlay-aware glyph alone carries the live signal (status / ⟳ / ⚠). */
+export declare function renderGraphRow(r: FlatRow, isCursor: boolean, focused: ReadonlySet<string>, activeBelow: ReadonlyMap<string, number>, asks: Record<string, number>): string;

package/dist/core/canvas/nav-model.js

@@ -0,0 +1 @@
+var R=Object.defineProperty;var o=(t,e)=>R(t,"name",{value:e,configurable:!0});import{getNode as $,subscribersOf as y,subscriptionsOf as I}from"./index.js";import{faultSummary as C}from"./status-glyph.js";import{statusRank as S}from"./node-order.js";import{nodeGlyph as _,navLabel as G,shortId as O,tokensCell as T,activityCell as D,cycleBadge as W,askBadge as L,liveBelowBadge as M,truncate as N,fillBar as w,fillWidth as k,isAttached as H,BOLD as K,DIM as g,RESET as m,REVERSE as P,BG_ATTACHED as V}from"./nav-render.js";import{PI_MAX_WIDGET_LINES as dt,VIEWPORT_FALLBACK_ROWS as ft,ESC as ht,RESET as pt,BOLD as $t,DIM as mt,REVERSE as vt,BG_ATTACHED as Et,GREEN as xt,RED as gt,YELLOW as Bt,CYAN as bt,GRAY as St,nodeGlyph as wt,visibleWidth as kt,truncate as At,fillWidth as Rt,fillBar as yt,fmtTokens as It,tokensCell as Ct,activityCell as _t,cycleBadge as Gt,navLabel as Ot,shortId as Tt,askBadge as Dt,liveBelowBadge as Wt,isAttached as Lt,hasBrokerViewers as Mt,fetchAsksMap as Nt,graphWidgetBudget as Ht,GRAPH_HINT as Kt}from"./nav-render.js";function Y(t){try{return I(t)}catch{return[]}}o(Y,"subsOf");function F(t){try{return y(t)}catch{return[]}}o(F,"mgrsOf");function q(t){return F(t)[0]?.node_id}o(q,"managerOf");function X(t){return $(t)?.kind==="human"}o(X,"isHumanAsk");function v(t){return Y(t).map(e=>e.node_id).filter(e=>!X(e))}o(v,"convoChildIds");function rt(t){return v(t).filter(e=>{const s=$(e)?.status;return s==="active"||s==="idle"})}o(rt,"liveReports");function j(t){return v(t).length}o(j,"childCount");function z(t){let e=t;const s=new Set([e]);for(;;){const c=q(e);if(c===void 0||s.has(c))break;s.add(c),e=c}return e}o(z,"climbRoot");function ct(t){const e=[],s=new Set([t]),c=v(t);for(;c.length>0;){const l=c.shift();if(!s.has(l)){s.add(l),e.push(l);for(const u of v(l))s.has(u)||c.push(u)}}return e}o(ct,"subtreeIds");function J(t){if(t===null)return"";const e=j(t.node_id);return e>0?` ${g}\u2933${e}${m}`:""}o(J,"childBadge");function Q(t){return v(t).sort((e,s)=>S($(e)?.status)-S($(s)?.status))}o(Q,"sortedChildIds");function U(t,e){const s=new Set,c=new Map,l=new Set,u=o(n=>{const i=$(n)?.status==="active";if(l.has(n))return{active:i?1:0,reveal:i||n===e};l.add(n);let d=0,r=!1;for(const h of v(n)){const f=u(h);d+=f.active,f.reveal&&(r=!0)}return c.set(n,d),r&&s.add(n),{active:d+(i?1:0),reveal:r||i||n===e}},"visit");return u(t),{expand:s,activeBelow:c}}o(U,"computeSubtreeActivity");function Z(t,e){return U(t,e).expand}o(Z,"computeDefaultExpanded");function at(t,e,s){const c=z(t),l=s??Z(c,t),u=o(r=>e.userExpanded.has(r)?!1:e.userCollapsed.has(r)?!0:!l.has(r),"isFolded"),n=[],i=new Set,d=o((r,h,f,E)=>{if(i.has(r)){const a=f?"":E?"\u2514\u2500 ":"\u251C\u2500 ";n.push({id:r,hasKids:!1,isSelf:r===t,branch:h+a,cycle:!0,collapsed:!1});return}i.add(r);const p=Q(r),x=u(r),B=f?"":E?"\u2514\u2500 ":"\u251C\u2500 ";if(n.push({id:r,hasKids:p.length>0,isSelf:r===t,branch:h+B,cycle:!1,collapsed:x}),x)return;const b=f?"":h+(E?"   ":"\u2502  ");for(let a=0;a<p.length;a++)d(p[a],b,!1,a===p.length-1)},"walk");return d(c,"",!0,!0),n}o(at,"buildGraphModel");function lt(t,e,s,c,l){const u=o((a,A)=>e?w(a,k(),P):A?w(a,k(),V):N(a),"wrap");if(t.cycle){const a=`${t.branch}  ${g}\u21BA ${O(t.id)}${m}`;return u(a,!1)}const n=$(t.id),i=_(n),d=G(n,t.id),r=t.isSelf?`${K}${d}${m}`:d,h=`${g}${n?.kind??""}${m}`,f=`${g}${T(n)}${m}`,E=t.hasKids&&t.collapsed,p=!e&&E?`${g}\u25B8${m} `:"  ",x=n?.fault??null,B=x!==null?` \xB7 ${C(x)}`:"",b=`${t.branch}${p}${i} ${r} ${h} ${f}${W(n)}${J(n)}${M(n,c)}${L(t.id,l)}${D(n)}${B}`;return u(b,H(t.id,n,s))}o(lt,"renderGraphRow");export{Et as BG_ATTACHED,$t as BOLD,bt as CYAN,mt as DIM,ht as ESC,Kt as GRAPH_HINT,St as GRAY,xt as GREEN,dt as PI_MAX_WIDGET_LINES,gt as RED,pt as RESET,vt as REVERSE,ft as VIEWPORT_FALLBACK_ROWS,Bt as YELLOW,_t as activityCell,Dt as askBadge,at as buildGraphModel,J as childBadge,j as childCount,z as climbRoot,Z as computeDefaultExpanded,U as computeSubtreeActivity,v as convoChildIds,Gt as cycleBadge,Nt as fetchAsksMap,yt as fillBar,Rt as fillWidth,It as fmtTokens,Ht as graphWidgetBudget,Mt as hasBrokerViewers,Lt as isAttached,X as isHumanAsk,Wt as liveBelowBadge,rt as liveReports,q as managerOf,Ot as navLabel,wt as nodeGlyph,lt as renderGraphRow,Tt as shortId,Q as sortedChildIds,ct as subtreeIds,Ct as tokensCell,At as truncate,kt as visibleWidth};

package/dist/core/canvas/nav-render.d.ts

@@ -0,0 +1,136 @@
+import type { Fault } from '../fault-classifier.js';
+import type { NodeStatus } from './types.js';
+/** The node fields these helpers display — satisfied by `NodeMeta`, by
+ *  `NodeRow`, and by the lean `GET /v1/canvas/graph` row the attach graph reads.
+ *  Declared narrow so a caller holding only the display projection needs no full
+ *  node record. */
+export interface NavNode {
+    node_id: string;
+    name: string;
+    kind: string;
+    description?: string;
+    cycles?: number;
+    status: NodeStatus;
+    frozen_at?: string | null;
+    pi_pid?: number | null;
+    streaming?: boolean;
+    telemetry_context_tokens?: number | null;
+    telemetry_last_activity?: string | null;
+    fault?: Fault | null;
+}
+/** pi's InteractiveMode.MAX_WIDGET_LINES — the hard cap on lines in a string
+ *  array widget; anything beyond it pi truncates with its own "... (widget
+ *  truncated)". Our GRAPH viewport stays at/under this and scrolls internally. */
+export declare const PI_MAX_WIDGET_LINES = 10;
+export declare const VIEWPORT_FALLBACK_ROWS = 30;
+export declare const ESC = "\u001B[";
+export declare const RESET = "\u001B[0m";
+export declare const BOLD = "\u001B[1m";
+export declare const DIM = "\u001B[2m";
+export declare const REVERSE = "\u001B[7m";
+/** Dark-green background bar marking an ATTACHED node (a human is currently
+ *  watching it) — distinct from the cursor's reverse-video bar; chosen so
+ *  default-fg text stays readable. */
+export declare const BG_ATTACHED = "\u001B[48;5;22m";
+export declare const GREEN = "\u001B[32m";
+export declare const RED = "\u001B[31m";
+export declare const YELLOW = "\u001B[33m";
+export declare const CYAN = "\u001B[36m";
+export declare const GRAY = "\u001B[90m";
+/** Overlay-aware glyph for a node: hanging ⚠ outranks streaming ⟳, which
+ *  outranks the base status glyph. Every input is a projected row field — the
+ *  owning daemon computed `fault`/`streaming` — so this holds for a remote node
+ *  too, with no local read keyed on a node id that may collide. */
+export declare function nodeGlyph(node: NavNode | null): string;
+/** Drop every SGR sequence, keeping the visible text. The selection bar uses
+ *  this: reverse-video INVERTS a coloured cell into a coloured block, so a row
+ *  built from tinted spans highlights as a patchwork of background swatches
+ *  instead of one bar. Stripping colour first leaves a single clean bar — the
+ *  glyphs (●/○/✓/✗/⚙/◷) still carry the signal, exactly as under NO_COLOR. */
+export declare function stripSgr(s: string): string;
+/** Visible width, ignoring ANSI escapes. */
+export declare function visibleWidth(s: string): number;
+/** Truncate to `max` VISIBLE columns: escape sequences are copied through
+ *  verbatim (so a cut never lands mid-escape) and the result always ends in
+ *  RESET, so a clipped style can't bleed into the editor below. */
+export declare function truncate(s: string, max?: number): string;
+/** Visible columns available to ONE widget line — the cap for every line we
+ *  emit, and the width a full-width reverse-video SELF bar fills to.
+ *
+ *  pi does NOT clip widget lines; it WRAPS them. Each string line is wrapped in
+ *  a `Text(paddingX = 1)` inside a full-terminal-width container, so the usable
+ *  content width is `columns - 2` (a 1-col margin on each side). A line wider
+ *  than that wraps, and the overflow spills onto a second row as a stray
+ *  reverse-video block (the bug this guards against). Clamp to `columns - 2`. */
+export declare function fillWidth(): number;
+/** Wrap `content` in a full-width background bar opened by `open` (REVERSE for
+ *  the cursor, BG_ATTACHED for a human-watched node). `open` is re-asserted after every
+ *  embedded RESET so a coloured cell (the status dot) can't punch a hole in the
+ *  bar; the visible width is padded out to `width`; the line closes with a real
+ *  RESET so the style never bleeds into the editor below. */
+export declare function fillBar(content: string, width: number, open: string): string;
+export declare function fmtTokens(n: number): string;
+/** The context-window cell — live window fill rounded to the nearest 1k (the same
+ * figure pi's footer shows), NOT a per-turn delta. Remote canvases retain the
+ * existing safe 0 display rather than treating a local node id as remote state. */
+export declare function tokensCell(node: NavNode | null, remote?: boolean): string;
+/** Dimmed live "what is it doing" cue for an ACTIVE node — the last tool it ran.
+ * Empty for non-active rows and when none is recorded. */
+export declare function activityCell(node: NavNode | null, remote?: boolean): string;
+/** Revive-count badge (meta.cycles). Hidden on the first cycle (0) to cut noise. */
+export declare function cycleBadge(node: NavNode | null): string;
+/** Short on-screen label: the explicit handle when set, else the pi-generated
+ *  description, else the bare name. fullName joins BOTH (`handle description`);
+ *  the nav chrome shows just the first so rows stay compact. */
+export declare function navLabel(node: NavNode | null, id: string): string;
+export declare function shortId(id: string): string;
+/** True when a human is watching `id` right now via the broker viewer count
+ *  (attach.json). The tmux-focus axis (a `focuses` row) is a canvas-db read and
+ *  stays in nav-model's `isAttached`, which ORs this signal with the focus set.
+ *  `remote` skips the local `attach.json` read entirely and reports false (a
+ *  remote node id may collide with a local one). */
+export declare function hasBrokerViewers(id: string, node: NavNode | null, remote?: boolean): boolean;
+/** True when a human is watching `id` right now (tmux focus or broker viewer).
+ *  `focused` is the tmux-focus set (a canvas-db read the caller supplies). The
+ *  broker-viewer half is a pure `attach.json` read. `remote` skips the local read
+ *  entirely and reports false (a remote node id may collide with a local one). */
+export declare function isAttached(id: string, node: NavNode | null, focused: ReadonlySet<string>, remote?: boolean): boolean;
+/** ⚑K pending-asks badge for a node, read from the supplied per-node ask map. */
+export declare function askBadge(id: string, asks: Record<string, number>): string;
+/** "Live work below" badge — green ⇣N when this node is NOT itself active but has
+ *  N active descendants. The one signal that an idle/parked node isn't dead: real
+ *  work is still running beneath it. Count comes from the single subtree-activity
+ *  pass (no per-row walk). Suppressed on active rows (their own ● already says so). */
+export declare function liveBelowBadge(node: NavNode | null, activeBelow: ReadonlyMap<string, number>): string;
+export declare function fetchAsksMap(rootId: string): Record<string, number>;
+export interface FlatRow {
+    id: string;
+    hasKids: boolean;
+    isSelf: boolean;
+    branch: string;
+    cycle: boolean;
+    collapsed: boolean;
+}
+/** Manual fold OVERRIDES, keyed by id. `userCollapsed` forces a fold, `userExpanded`
+ *  forces an unfold; both override the default activity-driven policy. Held by the
+ *  consumer (the extension / viewer) and threaded into buildGraphModel so this layer
+ *  carries no mutable singletons. */
+export interface FoldState {
+    userExpanded: ReadonlySet<string>;
+    userCollapsed: ReadonlySet<string>;
+}
+/** One bottom-up O(N) pass result over the local graph (see computeSubtreeActivity
+ *  in nav-model.ts):
+ *   - `expand`: which nodes auto-UNFOLD — a node expands when a child subtree holds
+ *     a running ('active') agent or self.
+ *   - `activeBelow`: per node, the count of ACTIVE descendants (excluding itself). */
+export interface SubtreeActivity {
+    expand: Set<string>;
+    activeBelow: Map<string, number>;
+}
+/** Total lines the GRAPH widget may emit. pi hard-caps extension widgets at
+ *  MAX_WIDGET_LINES — anything past that pi truncates itself, eating our own
+ *  scroll chrome — so never exceed it (and shrink on a very short terminal).
+ *  The viewport scrolls WITHIN this cap as the cursor moves. */
+export declare function graphWidgetBudget(): number;
+export declare const GRAPH_HINT = "\u001B[2mjk move \u00B7 hl fold \u00B7 \u21B5 focus \u00B7 e expand \u00B7 x kill \u00B7 m mgr \u00B7 esc\u001B[0m";

package/dist/core/canvas/nav-render.js

@@ -0,0 +1 @@
+var f=Object.defineProperty;var n=(t,e)=>f(t,"name",{value:e,configurable:!0});import{execFileSync as m}from"node:child_process";import{join as x}from"node:path";import{nodeRunDir as $,nodeRunJobDir as h}from"./paths.js";import{readFileBeneath as g}from"../spaces/open-beneath.js";import{isFrozenRow as v,resolveNodeVisual as _}from"./status-glyph.js";const E=10,d=30,s="\x1B[",c=`${s}0m`,W=`${s}1m`,a=`${s}2m`,C=`${s}7m`,G=`${s}48;5;22m`,y=`${s}32m`,O=`${s}31m`,R=`${s}33m`,F=`${s}36m`,j=`${s}90m`;function k(t){return t.status!=="active"&&t.status!=="idle"?!1:t.streaming===!0}n(k,"streamingFor");function V(t){if(t===null)return"?";const e=_(t.status,{streaming:k(t),frozen:v(t),hanging:t.fault??null});return`${s}${e.color}m${e.glyph}${c}`}n(V,"nodeGlyph");const l=/\x1b\[[0-9;]*m/g;function H(t){return t.replace(l,"")}n(H,"stripSgr");function p(t){return t.replace(l,"").length}n(p,"visibleWidth");function A(t,e=B()){if(p(t)<=e)return t;let r="",o=0,i=0;for(;i<t.length&&o<e-1;){if(t[i]==="\x1B"){const u=/^\x1b\[[0-9;]*m/.exec(t.slice(i));if(u){r+=u[0],i+=u[0].length;continue}}r+=t[i],o++,i++}return`${r}\u2026${c}`}n(A,"truncate");function B(){return Math.max(20,Math.min((process.stdout.columns??80)-2,180))}n(B,"fillWidth");function J(t,e,r){const o=A(t,e),i=o.replace(/\x1b\[0m/g,`${c}${r}`),u=Math.max(0,e-p(o));return`${r}${i}${" ".repeat(u)}${c}`}n(J,"fillBar");function S(t){return t<1e3?`${t}`:`${Math.round(t/1e3)}k`}n(S,"fmtTokens");function P(t,e=!1){return S(e?0:t?.telemetry_context_tokens??0)}n(P,"tokensCell");function Y(t,e=!1){if(e||t?.status!=="active")return"";const r=(t.telemetry_last_activity??"").trim();return r===""?"":` ${a}\xB7 ${r}${c}`}n(Y,"activityCell");function z(t){const e=t?.cycles??0;return e>0?` ${a}\u27F3${e}${c}`:""}n(z,"cycleBadge");function K(t,e){if(t===null)return w(e);const r=t.name&&t.name!==t.kind?t.name:"";if(r!=="")return r;const o=(t.description??"").trim();return o!==""?o:t.name}n(K,"navLabel");function w(t){return t.slice(0,8)}n(w,"shortId");function b(t,e,r=!1){if(r||e?.status!=="active")return!1;try{const o=JSON.parse(g($(t),x(h(t),"attach.json")).toString("utf8"));return typeof o.viewers=="number"&&o.viewers>0}catch{return!1}}n(b,"hasBrokerViewers");function X(t,e,r,o=!1){return o?!1:r.has(t)?!0:b(t,e,o)}n(X,"isAttached");function q(t,e){const r=e[t]??0;return r>0?` ${R}\u2691${r}${c}`:""}n(q,"askBadge");function Q(t,e){if(t===null||t.status==="active")return"";const r=e.get(t.node_id)??0;return r>0?` ${y}\u21E3${r}${c}`:""}n(Q,"liveBelowBadge");function U(t){try{const e=m("crtr",["canvas","attention","map","--view",t,"--json"],{timeout:2500,encoding:"utf8"});return JSON.parse(e.trim()).counts??{}}catch{return{}}}n(U,"fetchAsksMap");function Z(){const t=process.stdout.rows??d;return Math.max(4,Math.min(E,t-4))}n(Z,"graphWidgetBudget");const tt=`${a}jk move \xB7 hl fold \xB7 \u21B5 focus \xB7 e expand \xB7 x kill \xB7 m mgr \xB7 esc${c}`;export{G as BG_ATTACHED,W as BOLD,F as CYAN,a as DIM,s as ESC,tt as GRAPH_HINT,j as GRAY,y as GREEN,E as PI_MAX_WIDGET_LINES,O as RED,c as RESET,C as REVERSE,d as VIEWPORT_FALLBACK_ROWS,R as YELLOW,Y as activityCell,q as askBadge,z as cycleBadge,U as fetchAsksMap,J as fillBar,B as fillWidth,S as fmtTokens,Z as graphWidgetBudget,b as hasBrokerViewers,X as isAttached,Q as liveBelowBadge,K as navLabel,V as nodeGlyph,w as shortId,H as stripSgr,P as tokensCell,A as truncate,p as visibleWidth};

package/dist/core/canvas/node-agent-paths.d.ts

@@ -0,0 +1,8 @@
+/** Resolve an existing node's app from the sole durable assignment, its row.
+ * Brokers have only their own app in their launch environment, not the DB. */
+export declare function appForNode(nodeId: string): string;
+export declare function nodeAgentDir(nodeId: string, grantee?: string): string;
+export declare function contextDir(nodeId: string, grantee?: string): string;
+export declare function reportsDir(nodeId: string, grantee?: string): string;
+export declare function interpolateNodePaths(text: string, nodeId: string): string;
+export declare function ensureNodeDirs(nodeId: string, grantee?: string): void;

package/dist/core/canvas/node-agent-paths.js

@@ -0,0 +1 @@
+var a=Object.defineProperty;var t=(r,e)=>a(r,"name",{value:e,configurable:!0});import{prepared as s}from"../sqlite-statements.js";import{join as p}from"node:path";import{envGrantee as u,envNodeId as f}from"../../shared/env.js";import{openDb as c}from"./db.js";import{nodeAgentDir as m,ensureNodeDirs as D,interpolateNodePaths as g}from"./paths.js";function o(r){const e=u();if(f()===r&&e)return e;const n=s(c(),"SELECT grantee FROM node_rows WHERE node_id = ?").get(r);if(!n?.grantee)throw new Error(`node ${r} has no app assignment`);return n.grantee}t(o,"appForNode");function i(r,e){return m(r,e??o(r))}t(i,"nodeAgentDir");function E(r,e){return p(i(r,e),"context")}t(E,"contextDir");function F(r,e){return p(i(r,e),"reports")}t(F,"reportsDir");function l(r,e){return g(r,e,o(e))}t(l,"interpolateNodePaths");function P(r,e){D(r,e??o(r))}t(P,"ensureNodeDirs");export{o as appForNode,E as contextDir,P as ensureNodeDirs,l as interpolateNodePaths,i as nodeAgentDir,F as reportsDir};

package/dist/core/canvas/node-order.d.ts

@@ -0,0 +1,24 @@
+import type { NodeStatus, Lifecycle } from './types.js';
+/** Sort live work before terminal work; unknown statuses sort last. */
+export declare function statusRank(status: NodeStatus | undefined): number;
+/** True when the node has a broker the daemon supervises — the statuses that
+ *  mean "a live engine is (or should be) running right now". */
+export declare function isLiveStatus(status: NodeStatus | undefined): boolean;
+/** True when a node's work is FINISHED — a terminal one-shot worker, or any node
+ *  that pushed a final report.
+ *
+ *  This is deliberately NOT "is it running": a non-live status alone conflates two
+ *  unrelated situations. Finished work is archive — opening it is inspection, and
+ *  relaunching it puts a completed worker back to work (the stop-guard reprompts a
+ *  terminal node that never pushed a final). A RESIDENT node with no final report
+ *  is the opposite: its `done` is only `markCleanExitDone` recording a clean broker
+ *  exit, which the stop-guard itself rules a legitimate stop (`reason: 'dormant'`),
+ *  so it never finished anything and resuming it is simply reopening a conversation.
+ *
+ *  `lifecycle` is optional because DashboardRow only carries it on the full browser
+ *  snapshot; absent, this answers `true` (treat as finished), keeping the caller on
+ *  the conservative inspect-don't-revive path. */
+export declare function isFinishedWork(node: {
+    lifecycle?: Lifecycle;
+    finalized: boolean;
+}): boolean;

package/dist/core/canvas/node-order.js

@@ -0,0 +1 @@
+var n=Object.defineProperty;var r=(e,t)=>n(e,"name",{value:t,configurable:!0});function c(e){switch(e){case"active":return 0;case"idle":return 1;case"done":return 2;case"canceled":return 3;case"dead":return 4;default:return 5}}r(c,"statusRank");function a(e){return e==="active"||e==="idle"}r(a,"isLiveStatus");function u(e){return e.lifecycle!=="resident"||e.finalized}r(u,"isFinishedWork");export{u as isFinishedWork,a as isLiveStatus,c as statusRank};

package/dist/core/canvas/node-recap.d.ts

@@ -0,0 +1,23 @@
+export interface NodeRecap {
+    /** What this conversation is for — the recap's `Goal:` line. */
+    goal: string;
+    /** Where it actually stands — the recap's `State:` line. */
+    state: string;
+    /** ISO 8601 stamp of when the briefing was generated. */
+    at: string;
+}
+/** Split the model's two-line briefing into its labelled halves. Returns null for
+ *  anything that doesn't yield at least one non-empty line — a garbled recap is
+ *  worse than none, so it is never stored. Missing labels fall back to line order
+ *  (the prompt asks for Goal first, State second). */
+export declare function parseRecapBriefing(briefing: string): {
+    goal: string;
+    state: string;
+} | null;
+/** Persist a generated briefing. A failed write leaves the prior recap intact
+ * and must be reported to the broker before it paints the replacement. */
+export declare function writeNodeRecap(nodeId: string, briefing: string): void;
+/** The node's stored briefing, or undefined when it never generated one (a node
+ *  that finished before its first idle window, or one last run before this file
+ *  existed). Never throws. */
+export declare function readNodeRecap(nodeId: string): NodeRecap | undefined;

package/dist/core/canvas/node-recap.js

@@ -0,0 +1,2 @@
+var d=Object.defineProperty;var r=(e,t)=>d(e,"name",{value:t,configurable:!0});import{join as g}from"node:path";import{mkdirSync as m}from"node:fs";import{jobDir as c}from"./paths.js";import{readJsonIfExists as w,atomicWriteJson as y}from"../fs-utils.js";function l(e){return g(c(e),"recap.json")}r(l,"recapPath");function p(e){return e.replace(/^\s*(goal|state)\s*:\s*/i,"").trim()}r(p,"stripLabel");function b(e){const t=e.split(`
+`).map(i=>i.trim()).filter(i=>i!=="");if(t.length===0)return null;const n=r(i=>t.find(u=>new RegExp(`^${i}\\s*:`,"i").test(u)),"labelled"),o=n("goal")??t[0],a=n("state")??(t[1]!==o?t[1]:void 0),s=o===void 0?"":p(o),f=a===void 0?"":p(a);return s===""&&f===""?null:{goal:s,state:f}}r(b,"parseRecapBriefing");function L(e,t){const n=b(t);if(n===null)throw new TypeError("recap briefing has no goal or state");m(c(e),{recursive:!0}),y(l(e),{...n,at:new Date().toISOString()})}r(L,"writeNodeRecap");function S(e){const t=w(l(e));if(t===null||typeof t!="object")return;const n=typeof t.goal=="string"?t.goal:"",o=typeof t.state=="string"?t.state:"";if(!(n===""&&o===""))return{goal:n,state:o,at:typeof t.at=="string"?t.at:""}}r(S,"readNodeRecap");export{b as parseRecapBriefing,S as readNodeRecap,L as writeNodeRecap};

package/dist/core/canvas/node-sql-migration.d.ts

@@ -0,0 +1,4 @@
+import { DatabaseSync } from 'node:sqlite';
+export declare function recreateNodeRowsView(db: DatabaseSync): void;
+/** Imported by the shared appended consolidation transaction. The caller owns the transaction and user_version. */
+export declare function importNodeSqlAuthority(db: DatabaseSync): void;

package/dist/core/canvas/node-sql-migration.js

@@ -0,0 +1,80 @@
+var A=Object.defineProperty;var d=(e,r)=>A(e,"name",{value:r,configurable:!0});import{randomUUID as N}from"node:crypto";import{existsSync as m,readFileSync as h,readdirSync as x,realpathSync as X}from"node:fs";import{join as g,resolve as R}from"node:path";import{nodesRoot as L}from"./paths.js";const C=["node_id","name","created","cwd","kind","mode","lifecycle"];function f(e,r){return new Set(e.prepare(`PRAGMA table_info(${r})`).all().map(({name:i})=>i))}d(f,"columns");function U(e){const r=f(e,"nodes"),i=[["title","TEXT"],["icon","TEXT"],["spawned_by","TEXT"],["creator","TEXT"],["fork_from","TEXT"],["fork_source_file","TEXT"],["passive_default","INTEGER NOT NULL DEFAULT 0 CHECK (passive_default IN (0,1))"],["cycle_pending","INTEGER NOT NULL DEFAULT 0 CHECK (cycle_pending IN (0,1))"],["model_override","TEXT"],["persona_ack_json","TEXT"],["review_binding_json","TEXT"],["launch_config_json","TEXT"],["scopes_json","TEXT"]];for(const[n,t]of i)r.has(n)||e.exec(`ALTER TABLE nodes ADD COLUMN ${n} ${t}`);e.exec("CREATE INDEX IF NOT EXISTS idx_nodes_cycle_pending ON nodes(cycle_pending) WHERE cycle_pending = 1")}d(U,"addNodeColumns");function T(e){const r=R(e);return m(r)?X(r):r}d(T,"canonical");function l(e,r,i){if(e===void 0)return null;const n=JSON.stringify(e);if(n===void 0)throw new Error(`cannot serialize ${r} in ${i}`);return n}d(l,"json");function _(e,r,i){const n=e[r];if(typeof n!="string")throw new Error(`cannot import node metadata ${i}: ${r} must be a string`);return n}d(_,"requiredString");function a(e,r,i){const n=e[r];if(n==null)return null;if(typeof n!="string")throw new Error(`cannot import node metadata ${i}: ${r} must be a string or null`);return n}d(a,"optionalString");function O(e,r,i){const n=e[r];if(n==null)return null;if(typeof n!="number"||!Number.isFinite(n))throw new Error(`cannot import node metadata ${i}: ${r} must be a finite number or null`);return n}d(O,"optionalNumber");function y(e,r,i){if(e!=null){if(typeof e!="object"||Array.isArray(e))throw new Error(`cannot import ${r} from ${i}: expected an object`);return e}}d(y,"optionalObject");function k(){if(!m(L()))return[];const e=[];for(const r of x(L(),{withFileTypes:!0})){if(!r.isDirectory())continue;const i=g(L(),r.name,"meta.json");if(!m(i))continue;let n;try{n=JSON.parse(h(i,"utf8"))}catch(t){throw new Error(`cannot import node metadata ${i}: ${t.message}`)}for(const t of C)if(n[t]===void 0||n[t]===null)throw new Error(`cannot import node metadata ${i}: missing required ${t}`);if(typeof n.node_id!="string"||n.node_id!==r.name)throw new Error(`cannot import node metadata ${i}: node_id does not match its directory`);e.push({path:i,meta:n})}return e}d(k,"readMetas");function D(e){return f(e,"nodes").has("pi_session_file")?new Map(e.prepare("SELECT node_id, pi_session_file FROM nodes WHERE pi_session_file IS NOT NULL").all().map(({node_id:i,pi_session_file:n})=>[i,n])):new Map}d(D,"sqlOnlyPaths");function F(e){e.exec(`
+CREATE TABLE IF NOT EXISTS sessions (
+  binding_id TEXT PRIMARY KEY,
+  session_id TEXT,
+  node_id TEXT NOT NULL REFERENCES nodes(node_id) ON DELETE CASCADE,
+  transcript_path TEXT,
+  source_session_id TEXT,
+  fork_entry_id TEXT,
+  created_at TEXT NOT NULL,
+  bound_at TEXT NOT NULL,
+  unbound_at TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_sessions_node ON sessions(node_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_sessions_session ON sessions(session_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_sessions_live_node ON sessions(node_id) WHERE unbound_at IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS idx_sessions_live_transcript ON sessions(transcript_path) WHERE unbound_at IS NULL AND transcript_path IS NOT NULL;
+CREATE TABLE IF NOT EXISTS executions (
+  execution_id TEXT PRIMARY KEY,
+  node_id TEXT NOT NULL REFERENCES nodes(node_id) ON DELETE CASCADE,
+  daemon_epoch TEXT,
+  pid INTEGER,
+  process_identity TEXT,
+  state TEXT NOT NULL CHECK (state IN ('launching','running','exited')),
+  started_at TEXT NOT NULL,
+  ended_at TEXT,
+  exit_reason TEXT,
+  CHECK ((state = 'exited') = (ended_at IS NOT NULL))
+);
+CREATE INDEX IF NOT EXISTS idx_executions_node ON executions(node_id, started_at);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_executions_live_node ON executions(node_id) WHERE state != 'exited';
+CREATE TABLE IF NOT EXISTS worktrees (
+  node_id TEXT PRIMARY KEY REFERENCES nodes(node_id) ON DELETE CASCADE,
+  state TEXT NOT NULL CHECK (state IN ('open','closed','abandoned')),
+  cleanup_state TEXT CHECK (cleanup_state IS NULL OR cleanup_state IN ('pending','complete')),
+  path TEXT NOT NULL,
+  branch TEXT NOT NULL,
+  repo_root TEXT NOT NULL,
+  base_ref TEXT NOT NULL,
+  base_sha TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  closed_at TEXT,
+  next_attempt_at TEXT,
+  attempts INTEGER NOT NULL DEFAULT 0 CHECK (attempts >= 0),
+  quarantined INTEGER NOT NULL DEFAULT 0 CHECK (quarantined IN (0,1)),
+  sweep_reason TEXT,
+  sweep_detail TEXT,
+  sweep_last_at TEXT,
+  sweep_observed_json TEXT,
+  abandoned_json TEXT,
+  land_intent_json TEXT,
+  disposal_json TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_worktrees_sweep ON worktrees(state, cleanup_state, next_attempt_at);
+`)}d(F,"createTables");function b(e,r,i){const n=e.prepare("INSERT INTO nodes (node_id, name, description, cycles, kind, mode, lifecycle, cwd, host_kind, profile_id, parent, created, title, icon, spawned_by, creator, fork_from, fork_source_file, passive_default, cycle_pending, model_override, persona_ack_json, review_binding_json, launch_config_json) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(node_id) DO UPDATE SET name=excluded.name, description=excluded.description, cycles=excluded.cycles, kind=excluded.kind, mode=excluded.mode, lifecycle=excluded.lifecycle, cwd=excluded.cwd, host_kind=excluded.host_kind, profile_id=excluded.profile_id, parent=excluded.parent, title=excluded.title, icon=excluded.icon, spawned_by=excluded.spawned_by, creator=excluded.creator, fork_from=excluded.fork_from, fork_source_file=excluded.fork_source_file, passive_default=excluded.passive_default, cycle_pending=excluded.cycle_pending, model_override=excluded.model_override, persona_ack_json=excluded.persona_ack_json, review_binding_json=excluded.review_binding_json, launch_config_json=excluded.launch_config_json");for(const{path:t,meta:o}of r){const s=_(o,"node_id",t),c=i.get(s),p=a(o,"pi_session_file",t);if(c!==void 0&&p!==null&&T(c)!==T(p))throw new Error(`cannot import node metadata ${t}: pi_session_file conflicts with indexed path ${c}`);n.run(s,_(o,"name",t),a(o,"description",t),O(o,"cycles",t),_(o,"kind",t),_(o,"mode",t),_(o,"lifecycle",t),_(o,"cwd",t),a(o,"host_kind",t),a(o,"profile_id",t),a(o,"parent",t),_(o,"created",t),a(o,"title",t),a(o,"icon",t),a(o,"spawned_by",t),a(o,"creator",t),a(o,"fork_from",t),a(o,"fork_source_file",t),o.passive_default===!0?1:0,o.cycle_pending===!0?1:0,a(o,"model_override",t),l(o.persona_ack,"persona_ack",t),l(o.review_binding,"review_binding",t),l(o.launch,"launch",t)),p!==null&&i.delete(s)}}d(b,"importMetas");function v(e,r){const i=new Set(e.prepare("SELECT node_id FROM nodes").all().map(({node_id:t})=>t)),n=e.prepare("INSERT INTO edges (type, from_id, to_id, active, created) VALUES ('spawned_by', ?, ?, 1, ?) ON CONFLICT(type, from_id, to_id) DO NOTHING");for(const{meta:t}of r){const o=t.node_id,s=typeof t.spawned_by=="string"?t.spawned_by:typeof t.parent=="string"?t.parent:null;s!==null&&i.has(o)&&i.has(s)&&n.run(o,s,new Date().toISOString())}}d(v,"importEdges");function j(e,r,i){const n=e.prepare("INSERT INTO sessions (binding_id, session_id, node_id, transcript_path, source_session_id, fork_entry_id, created_at, bound_at, unbound_at) VALUES (?, ?, ?, ?, NULL, NULL, ?, ?, NULL)"),t=new Map;for(const{path:o,meta:s}of r){const c=_(s,"node_id",o),p=i.get(c),E=typeof s.pi_session_file=="string"?s.pi_session_file:p,S=typeof s.pi_session_id=="string"?s.pi_session_id:null;if(E===void 0&&S===null)continue;const u=E===void 0?null:T(E);if(u!==null){const I=t.get(u);if(I!==void 0)throw new Error(`cannot import duplicate live transcript ${u}: ${I}, ${c}`);t.set(u,c)}const w=_(s,"created",o);n.run(N(),S,c,u,w,w),p!==void 0&&i.delete(c)}for(const[o,s]of i){const c=T(s),p=t.get(c);if(p!==void 0)throw new Error(`cannot import duplicate live transcript ${c}: ${p}, ${o}`);t.set(c,o);const E=e.prepare("SELECT created FROM nodes WHERE node_id = ?").get(o)?.created;E!==void 0&&n.run(N(),null,o,c,E,E)}}d(j,"importSessions");function $(e,r){const i=e.prepare("INSERT INTO worktrees (node_id, state, cleanup_state, path, branch, repo_root, base_ref, base_sha, created_at, closed_at, next_attempt_at, attempts, quarantined, sweep_reason, sweep_detail, sweep_last_at, sweep_observed_json, abandoned_json, land_intent_json, disposal_json) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");for(const{path:n,meta:t}of r){const o=y(t.managed_worktree,"managed worktree",n);if(o===void 0)continue;const s=y(o.sweep,"managed_worktree.sweep",n);i.run(_(t,"node_id",n),_(o,"state",n),a(o,"cleanup",n),_(o,"path",n),_(o,"branch",n),_(o,"repo_root",n),_(o,"base_ref",n),_(o,"base_sha",n),_(o,"created",n),a(o,"closed",n),s===void 0?null:a(s,"next_attempt",n),s===void 0?0:O(s,"attempts",n)??0,s?.quarantined===!0?1:0,s===void 0?null:a(s,"reason",n),s===void 0?null:a(s,"detail",n),s===void 0?null:a(s,"last_attempt",n),l(s?.observed,"managed_worktree.sweep.observed",n),l(o.abandoned,"managed_worktree.abandoned",n),l(o.land_intent,"managed_worktree.land_intent",n),l(o.disposal,"managed_worktree.disposal",n))}}d($,"importWorktrees");function H(e){if(!f(e,"nodes").has("pi_pid"))return;const i=e.prepare("SELECT node_id, pi_pid, pi_pid_identity, launched_at, created FROM nodes WHERE pi_pid IS NOT NULL").all(),n=e.prepare("INSERT INTO executions (execution_id, node_id, daemon_epoch, pid, process_identity, state, started_at, ended_at, exit_reason) VALUES (?, ?, NULL, ?, ?, 'running', ?, NULL, NULL)");for(const t of i)n.run(N(),t.node_id,t.pi_pid,t.pi_pid_identity,t.launched_at??t.created)}d(H,"importExecutions");function M(e,r){if(e.prepare("SELECT COUNT(*) AS count FROM nodes").get().count<r)throw new Error("node import removed an existing SQL row");if(e.prepare("PRAGMA foreign_key_check").all().length>0)throw new Error("node import foreign key check failed")}d(M,"validate");const W=`
+CREATE VIEW node_rows AS
+SELECT n.*,
+       CASE WHEN e.state = 'running' THEN e.pid ELSE NULL END AS pi_pid,
+       CASE WHEN e.state = 'running' THEN e.process_identity ELSE NULL END AS pi_pid_identity,
+       e.turn_open_at,
+       e.turn_closed_at,
+       s.session_id AS pi_session_id,
+       s.transcript_path AS pi_session_file,
+       f.fault_id,
+       f.link AS fault_link,
+       f.op AS fault_op,
+       f.kind AS fault_kind,
+       f.message AS fault_message,
+       f.since AS fault_since,
+       f.operation_id AS fault_operation_id,
+       f.anchor_entry_id AS fault_anchor_entry_id,
+       f.retry_disposition AS fault_retry_disposition,
+       f.retry_by AS fault_retry_by,
+       f.retry_attempt AS fault_retry_attempt,
+       f.retry_max AS fault_retry_max,
+       f.retry_next_at AS fault_retry_next_at,
+       f.provider_error_json AS fault_provider_error_json
+  FROM nodes n
+  LEFT JOIN executions e ON e.node_id = n.node_id AND e.state != 'exited'
+  LEFT JOIN sessions s ON s.node_id = n.node_id AND s.unbound_at IS NULL
+  LEFT JOIN node_faults f ON f.node_id = n.node_id AND f.active = 1`;function K(e){e.exec("DROP VIEW IF EXISTS node_rows"),e.exec(W)}d(K,"recreateNodeRowsView");function P(e){e.exec("DROP INDEX IF EXISTS idx_nodes_pi_session_file");const r=f(e,"nodes");for(const i of["pi_session_file","pi_pid","pi_pid_identity"])r.has(i)&&e.exec(`ALTER TABLE nodes DROP COLUMN ${i}`);K(e)}d(P,"dropLegacyColumnsAndCreateView");function B(e){const r=e.prepare("SELECT COUNT(*) AS count FROM nodes").get().count,i=D(e),n=k();U(e),F(e),b(e,n,i),v(e,n),j(e,n,i),$(e,n),H(e),M(e,r),P(e)}d(B,"importNodeSqlAuthority");export{B as importNodeSqlAuthority,K as recreateNodeRowsView};

package/dist/core/canvas/node-tokens.d.ts

@@ -0,0 +1,24 @@
+import { openDb } from './db.js';
+export interface NodePrincipal {
+    app: string;
+    node: string;
+    run: string | null;
+    uid: number;
+    sub: string;
+    grant: string | null;
+    client_id: string | null;
+    scopes: string[] | null;
+}
+export declare function mintNodeToken(db: ReturnType<typeof openDb>, executionId: string, nodeId: string, issuedAt: string): void;
+/** Called exactly once by the host at spawn, never serialized into a launch recipe. */
+export declare function takeNodeToken(executionId: string): string;
+export declare function forgetNodeToken(executionId: string): void;
+/** A stopped or superseded execution can never authenticate, even after restart. */
+export declare function resolveNodeToken(token: string): NodePrincipal | null;
+export declare function revokeExitedNodeToken(executionId: string): void;
+export declare function revokePriorEpochNodeTokens(epoch: string): void;
+/** OWN-11 for a joined runtime: a `user:local` subject becomes the owner, a
+ *  `user:local` grantee becomes `app:terminal` (no token has the owner as grantee),
+ *  and a reference to the dropped local grant is cleared. */
+export declare function rewriteLocalNodeTokenIdentity(db: ReturnType<typeof openDb>, owner: string, localGrantId: string): number;
+export declare function revokeNodeTokens(db: ReturnType<typeof openDb>, where: 'broker_process_id' | 'node_id', id: string, at: string): void;

package/dist/core/canvas/node-tokens.js

@@ -0,0 +1,5 @@
+var k=Object.defineProperty;var o=(e,n)=>k(e,"name",{value:n,configurable:!0});import{prepared as i}from"../sqlite-statements.js";import{createHash as m,randomBytes as N}from"node:crypto";import{openDb as _,prepared as T}from"./db.js";import{terminalGrant as f}from"../grants/mirror.js";import{readConfig as l}from"../config.js";import{uidForApp as S}from"../spaces/users.js";const s=new Map,E=o(e=>m("sha256").update(e).digest("hex"),"hash");function v(e,n,r,a){const t=i(e,"SELECT grantee, sub, grant_id, client_id, scopes_json, run_id FROM node_rows WHERE node_id = ?").get(r);if(!t)throw new Error(`cannot mint node token: missing node ${r}`);const d=t.run_id&&t.run_id!==r?i(e,"SELECT sub, grant_id, client_id FROM nodes WHERE node_id = ?").get(t.run_id):void 0,u=t.grantee==="app:terminal"?f():null,c=u?.sub??d?.sub??t.sub,g=u?.id??d?.grant_id??t.grant_id??null;if(t.grantee==="app:terminal"&&l("user").runtime?.issuer&&!u)throw new Error("cannot mint node token: terminal grant is not active");if(!c&&t.grantee!=="user:local"&&!(t.grantee==="app:terminal"&&!l("user").runtime?.issuer))throw new Error(`cannot mint node token: no subject for ${t.grantee}`);const p=N(32).toString("base64url");i(e,"INSERT INTO node_tokens (broker_process_id, node_id, token_hash, grantee, uid, sub, grant, client_id, scopes_json, issued_at, revoked_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)").run(n,r,E(p),t.grantee==="user:local"?"app:terminal":t.grantee,S(t.grantee==="user:local"?"app:terminal":t.grantee),c??"user:local",g,d?.client_id??t.client_id,t.scopes_json,a),s.set(n,p)}o(v,"mintNodeToken");function U(e){const n=s.get(e);if(s.delete(e),!n)throw new Error(`missing node token for execution ${e}`);return n}o(U,"takeNodeToken");function h(e){s.delete(e)}o(h,"forgetNodeToken");function H(e){if(!/^[A-Za-z0-9_-]{43}$/.test(e))return null;const n=T(_(),`SELECT t.node_id, t.grantee, t.uid, t.sub, t.grant, t.client_id, t.scopes_json, n.run_id
+    FROM node_tokens t JOIN executions e ON e.execution_id = t.broker_process_id
+    JOIN nodes n ON n.node_id = t.node_id
+    WHERE t.token_hash = ? AND t.revoked_at IS NULL AND e.state != 'exited'`).get(E(e));return n?{app:n.grantee,node:n.node_id,run:n.run_id,uid:n.uid,sub:n.sub,grant:n.grant,client_id:n.client_id,scopes:n.scopes_json===null?null:JSON.parse(n.scopes_json)}:null}o(H,"resolveNodeToken");function W(e){h(e),b(_(),"broker_process_id",e,new Date().toISOString())}o(W,"revokeExitedNodeToken");function j(e){i(_(),`UPDATE node_tokens SET revoked_at = ? WHERE revoked_at IS NULL
+    AND broker_process_id IN (SELECT execution_id FROM executions WHERE daemon_epoch IS NOT ?)`).run(new Date().toISOString(),e)}o(j,"revokePriorEpochNodeTokens");function P(e,n,r){return Number(i(e,"UPDATE node_tokens SET sub = ? WHERE sub = 'user:local'").run(n).changes)+Number(i(e,"UPDATE node_tokens SET grantee = 'app:terminal' WHERE grantee = 'user:local'").run().changes)+Number(i(e,'UPDATE node_tokens SET "grant" = NULL WHERE "grant" = ?').run(r).changes)}o(P,"rewriteLocalNodeTokenIdentity");function b(e,n,r,a){e.prepare(`UPDATE node_tokens SET revoked_at = ? WHERE ${n} = ? AND revoked_at IS NULL`).run(a,r)}o(b,"revokeNodeTokens");export{h as forgetNodeToken,v as mintNodeToken,H as resolveNodeToken,W as revokeExitedNodeToken,b as revokeNodeTokens,j as revokePriorEpochNodeTokens,P as rewriteLocalNodeTokenIdentity,U as takeNodeToken};

package/dist/core/canvas/outcome-actions.d.ts

@@ -0,0 +1,23 @@
+import type { DatabaseSync } from 'node:sqlite';
+import type { ObjectRow } from '../graph/types.js';
+import type { NodeOutcomeDocumentV1 } from '../runtime/outcome-document.js';
+import type { OutcomeDeliveryBinding } from './canvas.js';
+import { type DeliveryRecord } from './deliveries.js';
+export interface OutcomeActionRecord {
+    object: ObjectRow;
+    actionName: string;
+    argv: string[];
+    cwd: string;
+    configOrigin: string;
+    payload: unknown;
+    delivery: DeliveryRecord | null;
+    updatedAt: number;
+}
+/** Resolve only the live action belonging to this node, never an unrelated action of the same name. */
+export declare function readOutcomeAction(db: DatabaseSync, nodeId: string): OutcomeActionRecord | null;
+/** Register or replace an undelivered action in the caller's transaction. */
+export declare function registerOutcomeAction(db: DatabaseSync, nodeId: string, binding: OutcomeDeliveryBinding): void;
+/** Refuse removal after any delivery, including an acknowledged historical one. */
+export declare function unregisterOutcomeAction(db: DatabaseSync, nodeId: string): boolean;
+/** Late registration dispatches directly to its action, not to every outcome watcher. */
+export declare function enqueueLateOutcomeAction(db: DatabaseSync, nodeId: string, document: NodeOutcomeDocumentV1): void;

package/dist/core/canvas/outcome-actions.js

@@ -0,0 +1,6 @@
+var u=Object.defineProperty;var i=(o,t)=>u(o,"name",{value:t,configurable:!0});import{prepared as c}from"../sqlite-statements.js";import{createObject as m,nodeObject as d}from"../graph/objects.js";import{recordWatch as p}from"../graph/watches.js";import{argvReceiver as v}from"../graph/receivers.js";import{finalizeNodeMail as E,insertMessage as j}from"../feed/messages.js";import{deliveryFrom as f}from"./deliveries.js";function l(o,t){const e=c(o,`SELECT a.*, c.receiver_json, c.payload_json FROM objects a
+    JOIN objects n ON n.id = ? AND n.type = 'node'
+    JOIN custom_objects c ON c.object = a.rowid
+    WHERE a.type = 'action' AND a.name = ? AND a.owner = n.owner AND a.deleted_at IS NULL
+    ORDER BY a.rowid DESC LIMIT 1`).get(t,`outcome/${t}`);if(!e)return null;const a=JSON.parse(e.receiver_json),r=c(o,"SELECT * FROM deliveries WHERE destination_id = ? ORDER BY created_at DESC, rowid DESC LIMIT 1").get(e.id);return{object:e,actionName:a.name,argv:a.argv,cwd:a.cwd,configOrigin:a.config_origin,payload:e.payload_json===null?null:JSON.parse(e.payload_json),delivery:r?f(r):null,updatedAt:a.updated_at??Date.parse(e.created_at)}}i(l,"readOutcomeAction");function S(o,t,e){const a=d(o,t),r=l(o,t);if(r?.delivery)throw new Error(`outcome action ${t} already has a delivery`);const n=r?.object??m(o,{type:"action",kind:null,owner:a.owner,privacy:"public",name:`outcome/${t}`,preview:e.actionName}),s=JSON.stringify({argv:e.argv,cwd:e.cwd,config_origin:e.configOrigin,name:e.actionName,updated_at:r?Math.max(Date.now(),r.updatedAt+1):Date.parse(n.created_at)});c(o,`INSERT INTO custom_objects (object, receiver_json, payload_json) VALUES (?, ?, ?)
+    ON CONFLICT(object) DO UPDATE SET receiver_json = excluded.receiver_json, payload_json = excluded.payload_json`).run(n.rowid,s,JSON.stringify(e.payload??null)),r?c(o,"UPDATE objects SET preview = ? WHERE rowid = ?").run(e.actionName,n.rowid):(c(o,"UPDATE objects SET reception = 2 WHERE rowid = ?").run(n.rowid),p(o,n,a,"spawn",{patterns:["outcome"],config:[{threshold:1,delivery:"after-turn"}]}))}i(S,"registerOutcomeAction");function T(o,t){const e=l(o,t);return e?e.delivery?!1:(c(o,"DELETE FROM objects WHERE rowid = ?").run(e.object.rowid),!0):!0}i(T,"unregisterOutcomeAction");function A(o,t,e){const a=l(o,t);if(!a||a.delivery)throw new Error(`outcome action ${t} cannot be delivered again`);const r=d(o,t),n=E({senderNodeId:t,senderName:r.name,kind:"completed",label:`outcome node ${r.name}`,bodyJson:e,urgency:"normal"},null),s=j(o,{...n,senderNodeId:t,senderName:r.name,kind:"completed",label:`outcome node ${r.name}`,disposition:null,event:{event:"outcome",objectId:t,level:1,actorId:t}});v.enqueue(o,{messageId:s,event:"outcome",level:1,senderNodeId:t,elevatesTier:!1},[{id:a.object.id,reception:2,delivery:"after-turn"}])}i(A,"enqueueLateOutcomeAction");export{A as enqueueLateOutcomeAction,l as readOutcomeAction,S as registerOutcomeAction,T as unregisterOutcomeAction};

package/dist/core/canvas/paths.d.ts

@@ -0,0 +1,72 @@
+/** Runtime-owned records; never a bind source for an app sandbox. */
+export declare function crtrHome(): string;
+/** The canvas home requires durable storage with SQLite WAL locking support. */
+export declare function canvasDbPath(): string;
+export declare function onDiskMigrationLockPath(): string;
+export declare function onDiskMigrationMarkerPath(): string;
+/** The viewer socket belongs to the per-node run folder, not the durable records. */
+export declare function viewSocketPath(nodeId: string): string;
+export declare function nodesRoot(): string;
+export declare function reviewsRoot(): string;
+export declare function reviewDir(reviewId: string): string;
+export declare function reviewResultPath(reviewId: string): string;
+export declare function ensureReviewDir(reviewId: string): void;
+/** Absolute path to crtrd's API listener unix socket, a sibling of
+ *  `canvasDbPath()` under the canvas home (`~/.crouter/canvas/crtrd.sock` unless
+ *  `CRTR_HOME` is set). Pure path builder — no db reach — so both the daemon
+ *  (which binds it) and a CLI-side resolver can import it freely. `src/api`'s
+ *  `defaultSocketPath()` (in `api/node-transport.ts`) deliberately re-derives
+ *  this same path from a Node-builtin `join(crtrHome-equivalent, 'crtrd.sock')`
+ *  rather than importing here, to keep the exported `/api` contract
+ *  dependency-light; the two must agree. */
+export declare function apiSocketPath(): string;
+/** Global, cwd-agnostic broker cache of per-session picker metadata, keyed by
+ *  absolute `.jsonl` path. Shared across every node's broker (paths are absolute)
+ *  and survives broker restarts so the first `/resume` open after a restart is
+ *  also fast. Machine-local performance state — safe to delete; rebuilt on demand. */
+export declare function sessionListCachePath(): string;
+/** Whether a persisted node ID is safe as a single filesystem path segment. */
+export declare function isSafeNodeId(nodeId: string): boolean;
+export declare function nodeRecordDir(nodeId: string): string;
+/** Existing callers use nodeDir for the daemon's records only. */
+export declare const nodeDir: typeof nodeRecordDir;
+/** Pure path builder. A broker may resolve its own app from its launch identity;
+ *  every other caller must supply the app from the daemon's node row. */
+export declare function nodeAgentDir(nodeId: string, grantee?: string): string;
+/** The home folder of one node of an isolated run, `/apps/<A>/nodes/<id>/home`, used
+ *  in place of the app's shared `home` so two isolated runs share no writable folder. */
+export declare function isolatedNodeHome(nodeId: string, grantee: string): string;
+/** The HOME a node's processes get: its own home in an isolated run, else the app's. */
+export declare function nodeHome(nodeId: string, grantee: string, isolated: boolean): string;
+export declare function nodeRunDir(nodeId: string): string;
+export declare function contextDir(nodeId: string, grantee?: string): string;
+/** Replace the literal env-var tokens `$CRTR_CONTEXT_DIR` / `$CRTR_NODE_ID` in
+ *  agent-facing doc text with the node's real values, so a doc surfaced INTO a
+ *  node hands it a concrete absolute path instead of a shell-only string. The
+ *  env vars only expand in bash; an agent that pastes `$CRTR_CONTEXT_DIR/x.md`
+ *  into the (non-expanding) Write tool creates a literal `$CRTR_CONTEXT_DIR/`
+ *  dir under the project repo. The resolved absolute path works in both bash and
+ *  Write, so this substitution is strictly safer. Callers must only apply it
+ *  when they have a concrete node to render for (never on generic, node-less
+ *  output). Pure string work — no I/O. */
+export declare function interpolateNodePaths(text: string, nodeId: string, grantee?: string): string;
+export declare function jobDir(nodeId: string): string;
+export declare function nodeRunJobDir(nodeId: string): string;
+/** Overflow store for inbox entries whose inline body exceeds the digest's
+ *  bounded preview (a direct `node message send` or a close/cancel doctrine
+ *  wake) — the full body spills here, mirroring how a
+ *  push's body always lives in a file, never inline; the inbox entry then
+ *  carries `ref` at this path, same as a push pointer. */
+export declare function messagesDir(nodeId: string): string;
+export declare function nodeMetaPath(nodeId: string): string;
+export declare function inboxPath(nodeId: string): string;
+/** Rendered ambient context lives outside the user-authored context directory. */
+export declare function situationalContextPath(nodeId: string): string;
+export declare function passivePath(nodeId: string): string;
+export declare function transcriptPath(nodeId: string): string;
+export declare function sessionPtrPath(nodeId: string): string;
+/** Create the full directory skeleton for a node. Idempotent. The agent and
+ *  run folders are app-writable, so their subfolders are made beneath them. */
+export declare function ensureNodeDirs(nodeId: string, grantee: string): void;
+/** Ensure the canvas home exists. Idempotent. */
+export declare function ensureHome(): void;

package/dist/core/canvas/paths.js

@@ -0,0 +1 @@
+var P=Object.defineProperty;var r=(t,n)=>P(t,"name",{value:n,configurable:!0});import{join as e}from"node:path";import{mkdirSync as s}from"node:fs";import{appSpace as f,runtimeRoot as k,socketDir as m}from"../layout.js";import{envGrantee as R,envNodeId as w}from"../../shared/env.js";import{withDirBeneath as h}from"../spaces/open-beneath.js";function i(){return k()}r(i,"crtrHome");function H(){return e(i(),"canvas.db")}r(H,"canvasDbPath");function B(){return e(i(),"on-disk-migration.lock")}r(B,"onDiskMigrationLockPath");function L(){return e(i(),"on-disk-migrations.json")}r(L,"onDiskMigrationMarkerPath");function O(t){return e(a(t),"view.sock")}r(O,"viewSocketPath");function D(){return e(i(),"nodes")}r(D,"nodesRoot");function b(){return e(i(),"reviews")}r(b,"reviewsRoot");function l(t){return c(t),e(b(),t)}r(l,"reviewDir");function $(t){return e(l(t),"result.json")}r($,"reviewResultPath");function X(t){s(l(t),{recursive:!0,mode:448})}r(X,"ensureReviewDir");function F(){return e(m(),"api.sock")}r(F,"apiSocketPath");function G(){return e(i(),"session-list-cache.json")}r(G,"sessionListCachePath");const j=128;function g(t){return typeof t=="string"&&t!==""&&t!=="."&&t!==".."&&!/[\\/\0]/u.test(t)&&Buffer.byteLength(t,"utf8")<=j}r(g,"isSafeNodeId");function c(t){if(!g(t))throw new TypeError("node_id must be a non-empty path segment of at most 128 UTF-8 bytes")}r(c,"assertSafeNodeId");function p(t){return c(t),e(D(),t)}r(p,"nodeRecordDir");const u=p;function x(t,n){c(t);const o=n??(w()===t?R():void 0);if(!o)throw new Error(`node ${t} has no app assignment`);return e(f(o).nodes,t)}r(x,"nodeAgentDir");function N(t,n){return e(x(t,n),"home")}r(N,"isolatedNodeHome");function J(t,n,o){return o?N(t,n):f(n).home}r(J,"nodeHome");function a(t){return c(t),process.platform==="linux"?e(m(),"nodes",t):e(p(t),"run")}r(a,"nodeRunDir");function _(t,n){return e(x(t,n),"context")}r(_,"contextDir");function U(t,n,o){return t.replaceAll("$CRTR_CONTEXT_DIR",_(n,o)).replaceAll("$CRTR_NODE_ID",n)}r(U,"interpolateNodePaths");function S(t){return e(p(t),"job")}r(S,"jobDir");function T(t){return e(a(t),"job")}r(T,"nodeRunJobDir");function Y(t){return e(u(t),"messages")}r(Y,"messagesDir");function q(t){return e(u(t),"meta.json")}r(q,"nodeMetaPath");function z(t){return e(u(t),"inbox.jsonl")}r(z,"inboxPath");function K(t){return e(a(t),"situational-context.md")}r(K,"situationalContextPath");function Q(t){return e(u(t),"passive.jsonl")}r(Q,"passivePath");function V(t){return e(u(t),"transcript.jsonl")}r(V,"transcriptPath");function W(t){return e(u(t),"session.ptr")}r(W,"sessionPtrPath");function Z(t,n){const o=x(t,n);s(p(t),{recursive:!0}),s(S(t),{recursive:!0});for(const v of["context","reports","attachments","worktree"])h(f(n).nodes,e(o,v),()=>{},!0);h(a(t),T(t),()=>{},!0)}r(Z,"ensureNodeDirs");function I(){s(D(),{recursive:!0})}r(I,"ensureHome");export{F as apiSocketPath,H as canvasDbPath,_ as contextDir,i as crtrHome,I as ensureHome,Z as ensureNodeDirs,X as ensureReviewDir,z as inboxPath,U as interpolateNodePaths,g as isSafeNodeId,N as isolatedNodeHome,S as jobDir,Y as messagesDir,x as nodeAgentDir,u as nodeDir,J as nodeHome,q as nodeMetaPath,p as nodeRecordDir,a as nodeRunDir,T as nodeRunJobDir,D as nodesRoot,B as onDiskMigrationLockPath,L as onDiskMigrationMarkerPath,Q as passivePath,l as reviewDir,$ as reviewResultPath,b as reviewsRoot,G as sessionListCachePath,W as sessionPtrPath,K as situationalContextPath,V as transcriptPath,O as viewSocketPath};