@north-light/cli 0.3.532 → 0.3.534

package/docs/public-api.md

@@ -44,7 +44,8 @@ comment-organized); this table is the map, not the inventory:
   the underlying storage file.
 - **Canvas reads** — `getNode`, `listNodes`, `nodeDir`, `asksForNodes`,
   `asksAcrossCanvas`, `readTelemetry`, `readContextTokens` (+ their types).
-  Read-only queries against the canvas.db-backed node graph.
+  Read-only queries against the node graph, which lives in the daemon's
+  supervised local Postgres.
 - **Broker client** — `ViewSocketClient`, `BrokerUnavailableError`. A typed
   client for a node's `view.sock`. A consumer that would rather not depend on
   this class can speak the frame protocol directly over the socket path
@@ -76,9 +77,17 @@ comment-organized); this table is the map, not the inventory:
 A consumer that runs alongside crtr (a separate process, a separate repo)
 also has a CLI/socket/schema surface to depend on instead of an import:
 `crtr sys version`, `crtr node message send`, the broker `view.sock`
-`reload_auth` subset, and the canvas.db byte-shape. Each of those is versioned
+`reload_auth` subset, and the `/v1` socket API. Each of those is versioned
 by the CLI's own `sys version` output rather than by a document here.
 
+The canvas is a supervised local Postgres owned by `crtrd`, not a file. The
+old `runtime/canvas.db` is no longer maintained: the first boot of a Postgres
+generation imports it and renames it `canvas.db.imported`. A sibling process
+reads the canvas through `/v1` or the root barrel's canvas reads above, never
+through the database itself. `crtr sys db export-sqlite` writes a `canvas.db`
+for rolling back to a SQLite generation; it is a one-time snapshot taken
+with the daemon stopped, not a live file to read.
+
 ## Packaging
 
 `docs/` is listed in `package.json#files`, so this note ships inside the

package/docs/sdk/release-notes.md

@@ -7,6 +7,19 @@ description: Behavior changes in @north-light/sdk that an app must act on, newes
 
 Changes to `@north-light/sdk` that can change what an existing app sees. Newest first.
 
+## 0.3.533
+
+A cron armed by a caller with no scope limit follows the grant, and a narrowed scope pauses it.
+
+- `POST /v1/crons` stores and returns `scopes: null` for a cron armed by a node, cron or app token with no scope limit, where it used to return a copy of the grant's scopes. A cron with `scopes: null` runs under the grant's current scopes at every fire, including scopes the grant gains later. A cron armed with an explicit scope list keeps it and is refused if the grant stops covering any of it.
+- A scheduled fire refused `scope_narrowed` now pauses the cron, recurring ones included (`state: paused` in `GET /v1/crons`), and notifies whoever armed it. Resume it with `POST /v1/crons/:id/resume` once the grant covers the scope again.
+
+Three reads take optional narrowing. Additive: no request or response an existing app sends or reads changes.
+
+- `GET /v1/canvas/roster` node rows carry an optional `description`. A runtime that predates the field omits it.
+- `GET /v1/crons` accepts `created_by=<node id>` and returns only the crons that node armed. An empty value is 400 `invalid_request`. An older runtime ignores the parameter and returns every cron, so filter on `created_by` yourself if you may talk to one.
+- `GET /v1/human/inbox/history` accepts `state=pending|resolved|canceled|passive` and returns only page tickets in that state. Any other value is 400 `invalid_request`. An older runtime ignores the parameter and returns every state.
+
 ## 0.3.527
 
 `POST /v1/nodes/:id/jobs/start` accepts a job prepared as already backgrounded. Additive: no request or response an existing app sends or reads changes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.532",
+  "version": "0.3.534",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -116,12 +116,12 @@
     "dev": "tsx --conditions=crtr-src src/cli.ts",
     "link": "npm link",
     "prepublishOnly": "npm run build",
-    "test": "CRTR_NO_DAEMON_AUTOSTART=1 node --conditions=crtr-src --import tsx/esm --import ./scripts/test-env-scrub.mjs --test --test-concurrency=$(node -p 'Math.max(4, require(`node:os`).availableParallelism() - 1)') --test-timeout=10000 ${CRTR_TEST_SHARD:+--test-shard=$CRTR_TEST_SHARD} 'src/**/__tests__/*.test.ts'",
-    "test:integration": "npm run build:sdk && CRTR_NO_DAEMON_AUTOSTART=1 node --conditions=crtr-src --import tsx/esm --import ./scripts/test-env-scrub.mjs --test --test-concurrency=$(node -p 'Math.min(8, Math.max(2, require(`node:os`).availableParallelism() - 1))') --test-timeout=60000 ${CRTR_TEST_SHARD:+--test-shard=$CRTR_TEST_SHARD} 'src/**/__tests__/integration/*.test.ts' 'packages/crouter-sdk/src/**/__tests__/integration/*.test.ts' 'packages/crouter-plugin/src/**/__tests__/integration/*.test.ts'",
+    "test": "CRTR_NO_DAEMON_AUTOSTART=1 node scripts/test-lane.mjs -- node --conditions=crtr-src --import tsx/esm --import ./scripts/test-env-scrub.mjs --test --test-concurrency=$(node -p 'Math.max(4, require(`node:os`).availableParallelism() - 1)') --test-timeout=10000 ${CRTR_TEST_SHARD:+--test-shard=$CRTR_TEST_SHARD} 'src/**/__tests__/*.test.ts'",
+    "test:integration": "npm run build:sdk && CRTR_NO_DAEMON_AUTOSTART=1 node scripts/test-lane.mjs -- node --conditions=crtr-src --import tsx/esm --import ./scripts/test-env-scrub.mjs --test --test-concurrency=$(node -p 'Math.min(8, Math.max(2, require(`node:os`).availableParallelism() - 1))') --test-timeout=60000 ${CRTR_TEST_SHARD:+--test-shard=$CRTR_TEST_SHARD} 'src/**/__tests__/integration/*.test.ts' 'packages/crouter-sdk/src/**/__tests__/integration/*.test.ts' 'packages/crouter-plugin/src/**/__tests__/integration/*.test.ts'",
     "test:seam": "npm run build && npm run test:seam:built",
     "test:sdk": "npm run build:api && npm run build:identity && node --conditions=crtr-src --import tsx/esm --test --test-timeout=60000 'packages/crouter-sdk/src/__tests__/*.test.ts' 'packages/crouter-sdk/src/__tests__/integration/*.test.ts'",
     "test:sdk:pg": "node -e \"if (!process.env.TEST_DATABASE_URL) { console.error('test:sdk:pg needs TEST_DATABASE_URL (a disposable PostgreSQL), e.g. docker run --rm -d -e POSTGRES_PASSWORD=pw -p 127.0.0.1:55432:5432 postgres:18-alpine; TEST_DATABASE_URL=postgres://postgres:pw@127.0.0.1:55432/postgres'); process.exit(1) }\" && node --conditions=crtr-src --import tsx/esm --test --test-timeout=60000 'packages/crouter-sdk/src/**/__tests__/**/*.pg.test.ts'",
-    "test:seam:built": "CRTR_NO_DAEMON_AUTOSTART=1 node --import ./scripts/test-env-scrub.mjs --test --test-concurrency=$(node -p 'Math.min(4, Math.max(2, require(`node:os`).availableParallelism() - 2))') --test-timeout=180000 ${CRTR_TEST_SHARD:+--test-shard=$CRTR_TEST_SHARD} 'dist/**/__tests__/seam/*.test.js'",
+    "test:seam:built": "CRTR_NO_DAEMON_AUTOSTART=1 node scripts/test-lane.mjs -- node --import ./scripts/test-env-scrub.mjs --test --test-concurrency=$(node -p 'Math.min(4, Math.max(2, require(`node:os`).availableParallelism() - 2))') --test-timeout=180000 ${CRTR_TEST_SHARD:+--test-shard=$CRTR_TEST_SHARD} 'dist/**/__tests__/seam/*.test.js'",
     "test:all": "npm test && npm run test:integration && npm run test:seam",
     "test:isolated": "node scripts/test-isolated.mjs",
     "build:identity": "tsc -p packages/crouter-identity/tsconfig.json"
@@ -140,7 +140,7 @@
   },
   "license": "UNLICENSED",
   "dependencies": {
-    "@north-light/identity": "0.3.532",
+    "@north-light/identity": "0.3.534",
     "@earendil-works/pi-agent-core": "1.1.0",
     "@earendil-works/pi-ai": "1.1.0",
     "@earendil-works/pi-coding-agent": "1.1.0",
@@ -155,6 +155,7 @@
     "esbuild": "^0.27.7",
     "jose": "^6.2.12",
     "marked": "18.0.11",
+    "pg": "^8.23.1",
     "proper-lockfile": "4.1.2",
     "remark-gfm": "^4.0.1",
     "remark-parse": "^11.0.0",
@@ -173,7 +174,6 @@
     "@types/proper-lockfile": "^4.1.4",
     "@types/ws": "^8.18.1",
     "mermaid": "11.17.2",
-    "pg": "^8.23.1",
     "tsx": "^4.0.0"
   }
 }

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.532",
+  "version": "0.3.534",
   "description": "Northlight access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.532",
+  "version": "0.3.534",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.532",
+      "version": "0.3.534",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -24,11 +24,12 @@
         "@milkdown/preset-gfm": "^7.22.3",
         "@milkdown/prose": "^7.22.3",
         "@milkdown/utils": "^7.22.3",
-        "@north-light/identity": "0.3.532",
+        "@north-light/identity": "0.3.534",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
         "marked": "18.0.11",
+        "pg": "^8.23.1",
         "proper-lockfile": "4.1.2",
         "remark-gfm": "^4.0.1",
         "remark-parse": "^11.0.0",
@@ -53,7 +54,6 @@
         "@types/proper-lockfile": "^4.1.4",
         "@types/ws": "^8.18.1",
         "mermaid": "11.17.2",
-        "pg": "^8.23.1",
         "tsx": "^4.0.0"
       }
     },
@@ -10127,7 +10127,6 @@
       "version": "8.23.1",
       "resolved": "https://registry.npmjs.org/pg/-/pg-8.23.1.tgz",
       "integrity": "sha512-aL96AHANtWjPLDOLqnhx+ngp9+UK7ETEU8VJrDCGvsSSi/mGLcWYsS6Herg7lmaBJe4uwrfqsa7gTEFaSizDoQ==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "pg-connection-string": "^2.14.1",
@@ -10162,14 +10161,12 @@
       "version": "2.14.1",
       "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.14.1.tgz",
       "integrity": "sha512-qR3kGNPBLpCNtz0evbKA0Y/MRFXwSSdT+pTJvYp/bXTcReZbvX1kzF0IyTc1QnxqF7AZbOeBhNL8R5mYQZV/MA==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/pg-int8": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/pg-int8/-/pg-int8-1.0.1.tgz",
       "integrity": "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==",
-      "devOptional": true,
       "license": "ISC",
       "engines": {
         "node": ">=4.0.0"
@@ -10179,7 +10176,6 @@
       "version": "3.14.0",
       "resolved": "https://registry.npmjs.org/pg-pool/-/pg-pool-3.14.0.tgz",
       "integrity": "sha512-gKtPkFdQPU3DksooVLi9LsjZxrsBUZIpa+7aVx+LV5pNh0KzP4Zleud2po+ConrxbuXGBJ6Hfer6hdgpIBpBaw==",
-      "devOptional": true,
       "license": "MIT",
       "peerDependencies": {
         "pg": ">=8.0"
@@ -10189,14 +10185,12 @@
       "version": "1.16.1",
       "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.16.1.tgz",
       "integrity": "sha512-p9VOFMiHB/ZbJATetbg+99PxssTVSQRnyuPSQ67mN1+1KBOjZaZ83ZQzltnxPhJwSsC3nwVjJ10DVJlerbFzLg==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/pg-types": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/pg-types/-/pg-types-2.2.0.tgz",
       "integrity": "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "pg-int8": "1.0.1",
@@ -10213,7 +10207,6 @@
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/pgpass/-/pgpass-1.0.5.tgz",
       "integrity": "sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "split2": "^4.1.0"
@@ -10286,7 +10279,6 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
       "integrity": "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=4"
@@ -10296,7 +10288,6 @@
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/postgres-bytea/-/postgres-bytea-1.0.1.tgz",
       "integrity": "sha512-5+5HqXnsZPE65IJZSMkZtURARZelel2oXUEO8rH83VS/hxH5vv1uHquPg5wZs8yMAfdv971IU+kcPUczi7NVBQ==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -10306,7 +10297,6 @@
       "version": "1.0.7",
       "resolved": "https://registry.npmjs.org/postgres-date/-/postgres-date-1.0.7.tgz",
       "integrity": "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -10316,7 +10306,6 @@
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/postgres-interval/-/postgres-interval-1.2.0.tgz",
       "integrity": "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "xtend": "^4.0.0"
@@ -11138,7 +11127,6 @@
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/split2/-/split2-4.2.0.tgz",
       "integrity": "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==",
-      "devOptional": true,
       "license": "ISC",
       "engines": {
         "node": ">= 10.x"
@@ -12378,7 +12366,6 @@
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
       "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=0.4"
@@ -12468,17 +12455,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.532",
+      "version": "0.3.534",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.532",
+      "version": "0.3.534",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.532",
+      "version": "0.3.534",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -12486,20 +12473,20 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.532",
+      "version": "0.3.534",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.532",
-        "@north-light/identity": "0.3.532"
+        "@north-light/api": "0.3.534",
+        "@north-light/identity": "0.3.534"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.532",
+      "version": "0.3.534",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.532",
-        "@north-light/identity": "0.3.532",
+        "@north-light/api": "0.3.534",
+        "@north-light/identity": "0.3.534",
         "jose": "^6.2.1"
       },
       "bin": {

package/scripts/install-runtime.mjs

@@ -4,7 +4,7 @@ import { createHash } from 'node:crypto';
 import { DatabaseSync } from 'node:sqlite';
 import { chmod, copyFile, lstat, mkdir, mkdtemp, readFile, readdir, readlink, rename, rm, symlink, writeFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
-import { homedir, hostname } from 'node:os';
+import { homedir, hostname, userInfo } from 'node:os';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { ENTRY_NAMES, GENERATION_ID, GENERATION_PACKAGE_NAME, MANIFEST_KEYS, MANIFEST_SCHEMA, contained, isKnownPackageName, isSealed, publishedMarkerPath, runtimeHome, sortInventory, validateManifestShape } from '../bin/runtime-generation-manifest.mjs';
@@ -169,8 +169,15 @@ async function assertCanvasSchemaCompatible(stage) {
     throw new Error('candidate runtime does not expose a valid canvas migration version');
   }
 
-  const canvasHome = process.env.CRTR_HOME || join(homedir(), '.crouter', 'canvas');
-  const dbPath = join(canvasHome, 'canvas.db');
+  const root = process.env.CRTR_HOME || (process.platform === 'linux' ? '/' : join(homedir(), '.crouter'));
+  const runtime = join(root, 'runtime');
+  if (process.env.CRTR_DATABASE_URL || existsSync(join(runtime, 'pg', 'data'))) {
+    await assertPostgresSchemaCompatible(stage, runtime);
+    return;
+  }
+
+  // No Postgres cluster yet: the canvas is still the SQLite file the next daemon boot imports.
+  const dbPath = join(runtime, 'canvas.db');
   try {
     await lstat(dbPath);
   } catch (error) {
@@ -191,6 +198,49 @@ async function assertCanvasSchemaCompatible(stage) {
   }
 }
 
+/** The candidate's Postgres canvas schema version, read from its own `schema-version.js`. */
+async function candidatePostgresSchemaVersion(stage) {
+  const { CANVAS_SCHEMA_VERSION: version } = await import(pathToFileURL(join(stage, 'dist', 'core', 'canvas', 'schema-version.js')).href);
+  if (!Number.isSafeInteger(version) || version < 1) throw new Error('candidate runtime does not expose a valid canvas schema version');
+  return version;
+}
+
+/** Read `canvas_meta.schema_version` from the live Postgres cluster and refuse a candidate older than it. A cluster that
+ *  is not running cannot be read, so the candidate is refused until the cluster is started. */
+async function assertPostgresSchemaCompatible(stage, runtime) {
+  const { default: pg } = await import('pg');
+  const supported = await candidatePostgresSchemaVersion(stage);
+  let socketDir = join(runtime, 'pg');
+  try { socketDir = (await readFile(join(runtime, 'pg', 'socket-dir'), 'utf8')).trim(); } catch (error) { if (error?.code !== 'ENOENT') throw error; }
+  const connectionString = process.env.CRTR_DATABASE_URL
+    ?? `postgresql://${encodeURIComponent(userInfo().username)}@/postgres?host=${encodeURIComponent(socketDir)}`;
+  const client = new pg.Client({ connectionString, connectionTimeoutMillis: 5000 });
+  try {
+    await client.connect();
+  } catch (error) {
+    if (!process.env.CRTR_DATABASE_URL && (error?.code === 'ENOENT' || error?.code === 'ECONNREFUSED')) {
+      throw new Error(
+        `refusing to select runtime: the Postgres cluster at ${socketDir} is not running, so its canvas schema version cannot be checked against this build (${supported}). ` +
+        'Start it with the currently selected generation (`crtr sys daemon start`) and install again.',
+      );
+    }
+    throw error;
+  }
+  try {
+    const exists = await client.query(`SELECT to_regclass('canvas_meta') AS t`);
+    const row = exists.rows[0].t === null ? { rows: [] } : await client.query(`SELECT value FROM canvas_meta WHERE key = 'schema_version'`);
+    const current = row.rows[0] === undefined ? undefined : Number(row.rows[0].value);
+    if (current !== undefined && current > supported) {
+      throw new Error(
+        `refusing to select runtime with canvas schema ${supported}: ` +
+        `the live database is already at version ${current}; install a descendant build instead`,
+      );
+    }
+  } finally {
+    await client.end();
+  }
+}
+
 /** Atomically mark generation `id` eligible as a sibling-fallback candidate
  *  (see `runtime-generation-manifest.mjs`'s `publishedMarkerPath` for the
  *  invariant this establishes) — write via temp file + rename IN

package/scripts/lib/isolation-env.mjs

@@ -7,7 +7,9 @@ import { basename, dirname, isAbsolute, join, relative, sep } from 'node:path';
 export function scrubInheritedBrokerEnv(env = process.env) {
   for (const key of Object.keys(env)) {
     if (key.startsWith('PI_') || (key.startsWith('CRTR_') &&
-      key !== 'CRTR_HOME' && key !== 'CRTR_RUNTIME_HOME' && key !== 'CRTR_NO_DAEMON_AUTOSTART' && key !== 'CRTR_BROKER_SIGNAL_LONG_PROOF')) {
+      key !== 'CRTR_HOME' && key !== 'CRTR_RUNTIME_HOME' && key !== 'CRTR_NO_DAEMON_AUTOSTART' && key !== 'CRTR_BROKER_SIGNAL_LONG_PROOF'
+      // The lane runner's test Postgres (scripts/test-lane.mjs): every file worker, subprocess, daemon and broker reaches it.
+      && key !== 'CRTR_TEST_PG_URL')) {
       delete env[key];
     }
   }