@north-light/crouter 0.3.154 → 0.3.157

package/dist/clients/attach/slash/dispatch.js

@@ -52,17 +52,6 @@ const CANVAS_NAMES = new Set(CANVAS_SLASH_COMMANDS.map((c) => c.name));
  *  (the in-process GRAPH overlay, already remote-safe — see overlays/graph.ts)
  *  and `/view` (a self-contained popup unrelated to `nodeId`) stay available. */
 const REMOTE_UNSAFE_CANVAS_NAMES = new Set(['promote', 'resume-node', 'context', 'node-metadata', 'rename', 'clear', 'mcp']);
-/** Native canvas commands an OBSERVER may not run — the ones that drive the
- *  engine or mutate the node, whether by frame or by shelling the crtr CLI:
- *  `/clear` sends `new_session`; `/promote` shells `crtr node promote` and then
- *  triggers a turn; `/rename` sends `set_session_name` and shells `crtr node
- *  config --name`; `/resume-node` opens the navigator whose Enter path focuses
- *  (and so revives) a node; `/mcp`'s panel actions ride a `prompt` frame into
- *  the engine. Deliberately NOT here — genuinely read-only or viewer-local:
- *  `/graph` (in-process overlay), `/context` and `/node-metadata` (read-only
- *  inspection popups), `/color` (this pane's tmux border + this viewer's name
- *  chip). */
-const OBSERVER_UNSAFE_CANVAS_NAMES = new Set(['clear', 'promote', 'rename', 'resume-node', 'view', 'mcp']);
 /** tmux named colours accepted by `/color` (plus `colourN`/`#rrggbb`, validated
  *  by pattern). Mirrors tmux's colour-name table so a typo is rejected with the
  *  options rather than silently ignored by tmux. */
@@ -89,53 +78,17 @@ const THINKING_LEVELS = new Set(Object.keys({
     max: true,
 }));
 const BUILTIN_NAMES = new Set(BUILTIN_SLASH_COMMANDS.map((c) => c.name));
-/** Builtin slash commands safe to run from a READ-ONLY viewer — a REMOTE
- *  attach (`--canvas`) or an `--observer` one —
+/** Builtin slash commands safe to run against a REMOTE attach (`--canvas`) —
  *  everything else in `BUILTIN_SLASH_COMMANDS` either drives the engine
  *  (`/model`, `/new`, `/compact`, `/name`, `/resume`, `/fork`, `/tree`,
  *  `/settings`, `/share`, `/clone`, `/import`, `/reload`, `/scoped-models`
  *  selection) or is viewer-local but operates on the WRONG host for a remote
  *  node (`/login`, `/logout` — LOCAL `auth.json` via `defaultAgentDir()`, not
- *  the remote broker's; for an observer, credentials it may not swap under a
- *  running engine). Blocked BEFORE the switch so a read-only viewer never even
- *  opens the picker only to have the eventual selection frame swallowed by
- *  InputController's `emitCommand` gate (defense-in-depth #2, not the only
- *  defense — see input/controller.ts DRIVE_FRAME_TYPES). */
-const READ_ONLY_SAFE_BUILTIN_NAMES = new Set(['copy', 'session', 'changelog', 'hotkeys', 'quit']);
-/** THE capability gate for a read-only viewer, keyed on the two fixed facts a
- *  session resolves once (`remote`, `role`) — so the answer for a given command
- *  cannot change mid-session. Returns the refusal notice, or `undefined` when
- *  this viewer may run the command. Both `dispatchSlashCommand` (so a direct
- *  caller is safe) and the InputController's submit path (so a refusal is
- *  reported before command dispatch) consult this one function; there is no
- *  second policy anywhere. */
-function readOnlyRefusal(name, ctx) {
-    const canvas = CANVAS_NAMES.has(name);
-    const builtinUnsafe = BUILTIN_NAMES.has(name) && !READ_ONLY_SAFE_BUILTIN_NAMES.has(name);
-    if (ctx.remote === true) {
-        if (canvas && REMOTE_UNSAFE_CANVAS_NAMES.has(name)) {
-            return `/${name} is not available for a remote attach (--canvas) — it acts on this machine's local canvas`;
-        }
-        if (builtinUnsafe)
-            return `/${name} is not available for a remote attach (--canvas) — view-only`;
-    }
-    if (ctx.remote !== true && (ctx.role ?? 'controller') !== 'controller') {
-        if ((canvas && OBSERVER_UNSAFE_CANVAS_NAMES.has(name)) || builtinUnsafe) {
-            return `/${name} is not available to a read-only observer attach (--observer) — it would drive this node`;
-        }
-    }
-    return undefined;
-}
-/** The same gate, entered from raw editor text: the InputController asks BEFORE
- *  dispatching so a refused command is reported without reaching command
- *  dispatch. Unrecognized (extension) commands answer `undefined` here — they
- *  ride the normal `prompt` path, which the controller's own drive gate covers. */
-export function readOnlySlashRefusal(text, ctx) {
-    const m = /^\/(\S+)\s*([\s\S]*)$/.exec(text.trim());
-    if (!m)
-        return undefined;
-    return readOnlyRefusal(m[1], ctx);
-}
+ *  the remote broker's). Blocked here BEFORE the switch so a remote attach
+ *  never even opens the picker only to have the eventual selection frame
+ *  swallowed by InputController's `emitCommand` gate (defense-in-depth #2,
+ *  not the only defense — see input/controller.ts DRIVE_FRAME_TYPES). */
+const REMOTE_SAFE_BUILTIN_NAMES = new Set(['copy', 'session', 'changelog', 'hotkeys', 'quit']);
 /** Every leading-command name this viewer consumes ENTIRELY locally — the
  *  message never reaches the engine as prose, whether dispatched or blocked
  *  with a notice (a remote-unsafe canvas/builtin command still returns
@@ -172,20 +125,13 @@ export function dispatchSlashCommand(text, ctx) {
     }
     // Canvas commands (reimplemented native in the viewer) — handled before the
     // builtin gate since they are neither pi builtins nor engine-extension commands.
-    if (CANVAS_NAMES.has(name)) {
-        const refusal = readOnlyRefusal(name, ctx);
-        if (refusal !== undefined) {
-            ctx.notify(refusal);
-            return true;
-        }
+    if (CANVAS_NAMES.has(name))
         return dispatchCanvasCommand(name, arg, ctx);
-    }
     // Unknown to us AND not a builtin → let the engine's extension runner have it.
     if (!BUILTIN_NAMES.has(name))
         return false;
-    const refusal = readOnlyRefusal(name, ctx);
-    if (refusal !== undefined) {
-        ctx.notify(refusal);
+    if (ctx.remote === true && !REMOTE_SAFE_BUILTIN_NAMES.has(name)) {
+        ctx.notify(`/${name} is not available for a remote attach (--canvas) — view-only`);
         return true;
     }
     switch (name) {
@@ -340,8 +286,14 @@ export function commandAutocompleteItems(commands = BUILTIN_SLASH_COMMANDS, remo
 /** Dispatch one of the native canvas commands. Always returns `true` (the
  *  command is viewer-owned — never forwarded to the engine as a prompt). */
 function dispatchCanvasCommand(name, arg, ctx) {
-    // The capability gate (`readOnlyRefusal`) already ran in dispatchSlashCommand,
-    // so everything reaching here is a command this viewer may run.
+    // Structural omission (withCanvasCommands) keeps these out of remote-mode
+    // autocomplete; this gate is the belt-and-suspenders that also makes them
+    // NOT EXECUTABLE if typed by hand — a remote node id has no relationship to
+    // this machine's local canvas.db (or, worse, collides with one that does).
+    if (ctx.remote && REMOTE_UNSAFE_CANVAS_NAMES.has(name)) {
+        ctx.notify(`/${name} is not available for a remote attach (--canvas) — it acts on this machine's local canvas`);
+        return true;
+    }
     switch (name) {
         case 'clear':
             // Claude-Code ergonomics: `/clear` == `/new` — drop the conversation and