@north-light/crouter 0.3.157 → 0.3.158

package/dist/clients/attach/slash/dispatch.js

@@ -52,6 +52,17 @@ const CANVAS_NAMES = new Set(CANVAS_SLASH_COMMANDS.map((c) => c.name));
  *  (the in-process GRAPH overlay, already remote-safe — see overlays/graph.ts)
  *  and `/view` (a self-contained popup unrelated to `nodeId`) stay available. */
 const REMOTE_UNSAFE_CANVAS_NAMES = new Set(['promote', 'resume-node', 'context', 'node-metadata', 'rename', 'clear', 'mcp']);
+/** Native canvas commands an OBSERVER may not run — the ones that drive the
+ *  engine or mutate the node, whether by frame or by shelling the crtr CLI:
+ *  `/clear` sends `new_session`; `/promote` shells `crtr node promote` and then
+ *  triggers a turn; `/rename` sends `set_session_name` and shells `crtr node
+ *  config --name`; `/resume-node` opens the navigator whose Enter path focuses
+ *  (and so revives) a node; `/mcp`'s panel actions ride a `prompt` frame into
+ *  the engine. Deliberately NOT here — genuinely read-only or viewer-local:
+ *  `/graph` (in-process overlay), `/context` and `/node-metadata` (read-only
+ *  inspection popups), `/color` (this pane's tmux border + this viewer's name
+ *  chip). */
+const OBSERVER_UNSAFE_CANVAS_NAMES = new Set(['clear', 'promote', 'rename', 'resume-node', 'view', 'mcp']);
 /** tmux named colours accepted by `/color` (plus `colourN`/`#rrggbb`, validated
  *  by pattern). Mirrors tmux's colour-name table so a typo is rejected with the
  *  options rather than silently ignored by tmux. */
@@ -78,17 +89,53 @@ const THINKING_LEVELS = new Set(Object.keys({
     max: true,
 }));
 const BUILTIN_NAMES = new Set(BUILTIN_SLASH_COMMANDS.map((c) => c.name));
-/** Builtin slash commands safe to run against a REMOTE attach (`--canvas`) —
+/** Builtin slash commands safe to run from a READ-ONLY viewer — a REMOTE
+ *  attach (`--canvas`) or an `--observer` one —
  *  everything else in `BUILTIN_SLASH_COMMANDS` either drives the engine
  *  (`/model`, `/new`, `/compact`, `/name`, `/resume`, `/fork`, `/tree`,
  *  `/settings`, `/share`, `/clone`, `/import`, `/reload`, `/scoped-models`
  *  selection) or is viewer-local but operates on the WRONG host for a remote
  *  node (`/login`, `/logout` — LOCAL `auth.json` via `defaultAgentDir()`, not
- *  the remote broker's). Blocked here BEFORE the switch so a remote attach
- *  never even opens the picker only to have the eventual selection frame
- *  swallowed by InputController's `emitCommand` gate (defense-in-depth #2,
- *  not the only defense — see input/controller.ts DRIVE_FRAME_TYPES). */
-const REMOTE_SAFE_BUILTIN_NAMES = new Set(['copy', 'session', 'changelog', 'hotkeys', 'quit']);
+ *  the remote broker's; for an observer, credentials it may not swap under a
+ *  running engine). Blocked BEFORE the switch so a read-only viewer never even
+ *  opens the picker only to have the eventual selection frame swallowed by
+ *  InputController's `emitCommand` gate (defense-in-depth #2, not the only
+ *  defense — see input/controller.ts DRIVE_FRAME_TYPES). */
+const READ_ONLY_SAFE_BUILTIN_NAMES = new Set(['copy', 'session', 'changelog', 'hotkeys', 'quit']);
+/** THE capability gate for a read-only viewer, keyed on the two fixed facts a
+ *  session resolves once (`remote`, `role`) — so the answer for a given command
+ *  cannot change mid-session. Returns the refusal notice, or `undefined` when
+ *  this viewer may run the command. Both `dispatchSlashCommand` (so a direct
+ *  caller is safe) and the InputController's submit path (so a refusal is
+ *  reported before command dispatch) consult this one function; there is no
+ *  second policy anywhere. */
+function readOnlyRefusal(name, ctx) {
+    const canvas = CANVAS_NAMES.has(name);
+    const builtinUnsafe = BUILTIN_NAMES.has(name) && !READ_ONLY_SAFE_BUILTIN_NAMES.has(name);
+    if (ctx.remote === true) {
+        if (canvas && REMOTE_UNSAFE_CANVAS_NAMES.has(name)) {
+            return `/${name} is not available for a remote attach (--canvas) — it acts on this machine's local canvas`;
+        }
+        if (builtinUnsafe)
+            return `/${name} is not available for a remote attach (--canvas) — view-only`;
+    }
+    if (ctx.remote !== true && (ctx.role ?? 'controller') !== 'controller') {
+        if ((canvas && OBSERVER_UNSAFE_CANVAS_NAMES.has(name)) || builtinUnsafe) {
+            return `/${name} is not available to a read-only observer attach (--observer) — it would drive this node`;
+        }
+    }
+    return undefined;
+}
+/** The same gate, entered from raw editor text: the InputController asks BEFORE
+ *  dispatching so a refused command is reported without reaching command
+ *  dispatch. Unrecognized (extension) commands answer `undefined` here — they
+ *  ride the normal `prompt` path, which the controller's own drive gate covers. */
+export function readOnlySlashRefusal(text, ctx) {
+    const m = /^\/(\S+)\s*([\s\S]*)$/.exec(text.trim());
+    if (!m)
+        return undefined;
+    return readOnlyRefusal(m[1], ctx);
+}
 /** Every leading-command name this viewer consumes ENTIRELY locally — the
  *  message never reaches the engine as prose, whether dispatched or blocked
  *  with a notice (a remote-unsafe canvas/builtin command still returns
@@ -125,13 +172,20 @@ export function dispatchSlashCommand(text, ctx) {
     }
     // Canvas commands (reimplemented native in the viewer) — handled before the
     // builtin gate since they are neither pi builtins nor engine-extension commands.
-    if (CANVAS_NAMES.has(name))
+    if (CANVAS_NAMES.has(name)) {
+        const refusal = readOnlyRefusal(name, ctx);
+        if (refusal !== undefined) {
+            ctx.notify(refusal);
+            return true;
+        }
         return dispatchCanvasCommand(name, arg, ctx);
+    }
     // Unknown to us AND not a builtin → let the engine's extension runner have it.
     if (!BUILTIN_NAMES.has(name))
         return false;
-    if (ctx.remote === true && !REMOTE_SAFE_BUILTIN_NAMES.has(name)) {
-        ctx.notify(`/${name} is not available for a remote attach (--canvas) — view-only`);
+    const refusal = readOnlyRefusal(name, ctx);
+    if (refusal !== undefined) {
+        ctx.notify(refusal);
         return true;
     }
     switch (name) {
@@ -286,14 +340,8 @@ export function commandAutocompleteItems(commands = BUILTIN_SLASH_COMMANDS, remo
 /** Dispatch one of the native canvas commands. Always returns `true` (the
  *  command is viewer-owned — never forwarded to the engine as a prompt). */
 function dispatchCanvasCommand(name, arg, ctx) {
-    // Structural omission (withCanvasCommands) keeps these out of remote-mode
-    // autocomplete; this gate is the belt-and-suspenders that also makes them
-    // NOT EXECUTABLE if typed by hand — a remote node id has no relationship to
-    // this machine's local canvas.db (or, worse, collides with one that does).
-    if (ctx.remote && REMOTE_UNSAFE_CANVAS_NAMES.has(name)) {
-        ctx.notify(`/${name} is not available for a remote attach (--canvas) — it acts on this machine's local canvas`);
-        return true;
-    }
+    // The capability gate (`readOnlyRefusal`) already ran in dispatchSlashCommand,
+    // so everything reaching here is a command this viewer may run.
     switch (name) {
         case 'clear':
             // Claude-Code ergonomics: `/clear` == `/new` — drop the conversation and