@north-light/crouter 0.3.166 → 0.3.168

package/dist/core/__tests__/broker-fork-seam.test.js

@@ -34,7 +34,6 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createAgentSessionServices, createAgentSessionFromServices, SessionManager, VERSION, } from '../runtime/broker-sdk.js';
-import { CANVAS_EXTENSIONS } from '../runtime/launch.js';
 import { buildBrokerSession } from '../runtime/broker.js';
 // M-9 (broker.ts fault-and-die model gate): buildBrokerSession with no cfg.model
 // now calls the REAL SDK's modelRegistry.getAvailable() and faults if it's empty
@@ -83,7 +82,7 @@ test('D2 broker fork branch: buildBrokerSession(cfg.forkFrom) yields a NEW id +
     //    if broker.ts:~1106 reverts to that throw, this rejects and the test goes RED.
     const cfg = {
         cwd: dir,
-        extensionPaths: [...CANVAS_EXTENSIONS, C3_EXT],
+        extensionPaths: [C3_EXT],
         forkFrom: srcFile,
         model: 'c3prov/c3model',
     };

package/dist/core/__tests__/broker-sdk-wiring.test.js

@@ -84,7 +84,7 @@ function cfg(cwd, extra = {}) {
 test('C3 — services path registers an extension model provider; the broker session gets it', async () => {
     const cwd = mkdtempSync(join(tmpdir(), 'crtr-c3-'));
     try {
-        const { session, services } = await buildBrokerSession(realEngine, cfg(cwd, { model: 'c3prov/c3model' }));
+        const { session, services } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [C3_EXT], model: 'c3prov/c3model' }));
         try {
             // The extension's provider was registered into the SERVICES model runtime (this
             // is the registerProvider step plain createAgentSession skips).
@@ -107,7 +107,7 @@ test('C3 — services path registers an extension model provider; the broker ses
 test('C3b — broker splits model thinking suffix before SDK registry lookup', async () => {
     const cwd = mkdtempSync(join(tmpdir(), 'crtr-c3b-'));
     try {
-        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { model: 'c3prov/c3model:high' }));
+        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [C3_EXT], model: 'c3prov/c3model:high' }));
         try {
             assert.equal(session.model?.id, 'c3model', 'C3b: suffixed model specs resolve by model id instead of falling back to SDK default');
         }
@@ -420,7 +420,7 @@ test('C5 — isLeadingEngineCommand against a REAL session (registered extension
     // proven against a plain object shaped like the real accessors.
     const cwd = mkdtempSync(join(tmpdir(), 'crtr-c5-cmd-'));
     try {
-        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [...brokerExts(), C5_EXT], model: 'c3prov/c3model' }));
+        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [C3_EXT, C5_EXT], model: 'c3prov/c3model' }));
         try {
             assert.equal(isLeadingEngineCommand('/devcmd', session), true, 'a real registered extension command matches');
             assert.equal(isLeadingEngineCommand('/devcmd extra args', session), true, 'space-separated still matches against a real session');
@@ -744,7 +744,7 @@ test('Major 6 (broker half) — engineLeadingCommandTokens degrades to empty per
 test('Major 6 (broker half) — engineLeadingCommandTokens against a REAL session enumerates the real registered extension command', async () => {
     const cwd = mkdtempSync(join(tmpdir(), 'crtr-m6-cmd-'));
     try {
-        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [...brokerExts(), C5_EXT], model: 'c3prov/c3model' }));
+        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [C3_EXT, C5_EXT], model: 'c3prov/c3model' }));
         try {
             const tokens = engineLeadingCommandTokens(session);
             assert.ok(tokens.includes('devcmd'), 'the real registered extension command name is present in the enumeration');

package/dist/core/__tests__/history-inbox.test.js

@@ -6,11 +6,12 @@
 // sender (`from`) is visible in both the read body and the artifact title.
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createNode } from '../canvas/canvas.js';
 import { closeDb } from '../canvas/db.js';
+import { contextDir } from '../canvas/paths.js';
 import { appendInbox } from '../feed/inbox.js';
 import { buildCorpus, resolveRef } from '../canvas/history.js';
 let home;
@@ -39,6 +40,15 @@ after(() => {
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
 });
+test('history corpus skips malformed frontmatter in another cwd', () => {
+    const broken = createNode(node('broken-frontmatter', '/tmp/hist-broken'));
+    const valid = createNode(node('valid-history', '/tmp/hist-valid'));
+    writeFileSync(join(contextDir(broken.node_id), 'copied-source.md'), '---\ndesc: "unterminated\n---\nsource text\n');
+    writeFileSync(join(contextDir(valid.node_id), 'result.md'), '---\ntitle: result\n---\n0a0afd613\n');
+    const corpus = buildCorpus({ allCwds: true }, { types: ['report', 'doc', 'roadmap'] });
+    assert.equal(corpus.some((a) => a.ref === `${broken.node_id}:context/copied-source.md`), false, 'invalid artifact is skipped');
+    assert.ok(corpus.some((a) => a.loadBody().includes('0a0afd613')), 'valid artifacts remain searchable');
+});
 test('default history excludes inbox; --type inbox includes it, with full sender-attributed bodies', () => {
     const cwd = '/tmp/hist-work';
     createNode(node('sender-1', cwd));

package/dist/core/__tests__/self-update.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/self-update.test.js

@@ -0,0 +1,46 @@
+import assert from 'node:assert/strict';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import test from 'node:test';
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+const SELF_UPDATE = join(ROOT, 'scripts', 'self-update.mjs');
+test('self-update installs the downloaded release without replacing the stable global shim', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'crtr-self-update-test-'));
+    try {
+        const release = join(directory, 'release');
+        const archive = join(directory, 'release.tgz');
+        const bin = join(directory, 'bin');
+        const stableShim = join(bin, 'crtr');
+        const marker = join(directory, 'selected');
+        const calls = join(directory, 'npm-calls');
+        const fakeBin = join(directory, 'fake-bin');
+        mkdirSync(join(release, 'scripts'), { recursive: true });
+        mkdirSync(bin);
+        mkdirSync(fakeBin);
+        writeFileSync(join(release, 'scripts', 'install-runtime.mjs'), `import { writeFileSync } from 'node:fs';\nwriteFileSync(process.env.CRTR_SELF_UPDATE_MARKER, 'selected');\n`);
+        execFileSync('tar', ['-czf', archive, '-C', release, '.']);
+        symlinkSync('../stable-crtr', stableShim);
+        writeFileSync(join(fakeBin, 'npm'), `#!/usr/bin/env node\nimport { copyFileSync, appendFileSync } from 'node:fs';\nimport { basename, join } from 'node:path';\nconst args = process.argv.slice(2);\nappendFileSync(process.env.CRTR_SELF_UPDATE_CALLS, args.join(' ') + '\\n');\nif (args[0] !== 'pack') process.exit(1);\nconst destination = args[args.indexOf('--pack-destination') + 1];\ncopyFileSync(process.env.CRTR_SELF_UPDATE_ARCHIVE, join(destination, basename(process.env.CRTR_SELF_UPDATE_ARCHIVE)));\nprocess.stdout.write(JSON.stringify([{ filename: basename(process.env.CRTR_SELF_UPDATE_ARCHIVE) }]));\n`);
+        chmodSync(join(fakeBin, 'npm'), 0o755);
+        const result = spawnSync(process.execPath, [SELF_UPDATE], {
+            encoding: 'utf8',
+            env: {
+                ...process.env,
+                PATH: `${fakeBin}:${process.env.PATH}`,
+                CRTR_SELF_UPDATE_ARCHIVE: archive,
+                CRTR_SELF_UPDATE_CALLS: calls,
+                CRTR_SELF_UPDATE_MARKER: marker,
+            },
+        });
+        assert.equal(result.status, 0, result.stderr);
+        assert.equal(readFileSync(marker, 'utf8'), 'selected');
+        assert.equal(readlinkSync(stableShim), '../stable-crtr');
+        assert.match(readFileSync(calls, 'utf8'), /^pack @north-light\/crouter@latest --json --pack-destination .+\/crtr-self-update-\S+\n$/);
+    }
+    finally {
+        rmSync(directory, { recursive: true, force: true });
+    }
+});

package/dist/core/auto-update.js

@@ -2,7 +2,7 @@ import { spawn } from 'node:child_process';
 import { readConfig, readState, updateState } from './config.js';
 import { nowIso } from './fs-utils.js';
 import { info } from './output.js';
-import { selfCheck, contentCheck } from './self-update.js';
+import { SELF_UPDATE_SCRIPT, selfCheck, contentCheck } from './self-update.js';
 const HOUR_MS = 60 * 60 * 1000;
 const SKIP_SUBCOMMANDS = new Set([
     'update',
@@ -27,7 +27,7 @@ function withinInterval(lastIso, intervalHours) {
     return Date.now() - last < intervalHours * HOUR_MS;
 }
 function spawnDetachedSelfUpdate() {
-    const child = spawn('npm', ['i', '-g', '@north-light/crouter@latest'], {
+    const child = spawn(process.execPath, [SELF_UPDATE_SCRIPT], {
         detached: true,
         stdio: 'ignore',
     });

package/dist/core/canvas/history.js

@@ -15,6 +15,7 @@ import { getNode, listNodes, view } from './canvas.js';
 import { contextDir, reportsDir, nodeDir, inboxPath } from './paths.js';
 import { readTextIfExists, walkFiles, pathExists } from '../fs-utils.js';
 import { parseFrontmatterGeneric } from '../frontmatter.js';
+import { warn } from '../output.js';
 /** The cwd the caller means by default: the calling node's cwd (resolved from
  *  CRTR_NODE_ID via the canvas data layer), falling back to the process cwd
  *  when not run as a node. */
@@ -242,6 +243,11 @@ function listDocFiles(nodeId) {
         return [];
     }
 }
+/** Keep one malformed artifact from breaking a cross-node corpus scan. */
+function warnInvalidFrontmatter(path, error) {
+    const message = (error instanceof Error ? error.message : String(error)).split('\n')[0];
+    warn(`invalid frontmatter in ${path}: ${message}`);
+}
 /** The node desc lives in meta.json, not the row — read it once per survivor. */
 function nodeDescOf(nodeId) {
     const n = getNode(nodeId);
@@ -281,7 +287,15 @@ export function buildCorpus(scope, corpus) {
             out.push(metaArtifact(row, desc));
         if (want.has('report')) {
             for (const f of listReportFiles(row.node_id)) {
-                const a = reportArtifact(row, desc, f);
+                const abs = join(reportsDir(row.node_id), f);
+                let a;
+                try {
+                    a = reportArtifact(row, desc, f);
+                }
+                catch (e) {
+                    warnInvalidFrontmatter(abs, e);
+                    continue;
+                }
                 if (a === null)
                     continue;
                 if (wantReportKind !== undefined && a.reportKind !== wantReportKind)
@@ -291,7 +305,14 @@ export function buildCorpus(scope, corpus) {
         }
         if (want.has('doc') || want.has('roadmap')) {
             for (const abs of listDocFiles(row.node_id)) {
-                const a = docArtifact(row, desc, abs);
+                let a;
+                try {
+                    a = docArtifact(row, desc, abs);
+                }
+                catch (e) {
+                    warnInvalidFrontmatter(abs, e);
+                    continue;
+                }
                 if (a.source === 'roadmap' && !want.has('roadmap'))
                     continue;
                 if (a.source === 'doc' && !want.has('doc'))

package/dist/core/canvas/pid.d.ts

@@ -1,17 +1,8 @@
-/** True if a process with `pid` is currently alive (signal-0 probe) AND not a
- *  zombie. `kill(pid, 0)` throws ESRCH when the process is gone; EPERM means
- *  it exists but isn't ours — still alive (a foreign process is never OUR
- *  zombie, so the `isZombie` check is skipped for that branch — see below). A
- *  null/undefined pid (legacy / never-booted) reads dead.
- *
- *  The zombie check matters because EVERY broker this module supervises is
- *  spawned `detached: true` by crtr itself (`headlessBrokerHost.launch`) — a
- *  dead broker whose spawning process hasn't reaped it yet is a zombie, and
- *  `kill(pid, 0)` alone reports it as alive, wedging the daemon's revive guard
- *  (`isPidAlive(pi_pid)`, `revive.ts`) forever: the daemon never revives an
- *  already-live-looking row, so a refreshed/crashed node whose broker zombied
- *  out under a long-lived spawning process (see `isZombie`'s doc) never comes
- *  back on its own. */
+/** True if a process with `pid` is currently alive. `kill(pid, 0)` provides the
+ *  initial existence check; EPERM means the foreign process exists. For our
+ *  processes, the later `ps` read is authoritative because it also distinguishes
+ *  zombies and processes reaped between the two probes. Only an unavailable
+ *  `ps` probe fails open to alive. A null/undefined pid reads dead. */
 export declare function isPidAlive(pid: number | null | undefined): boolean;
 /** THE single precision-aware identity compare, used EVERYWHERE two
  *  `composeIdentity` fingerprints are compared (this module's own

package/dist/core/canvas/pid.js

@@ -10,46 +10,31 @@
 import { spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { readKernelBootId } from './boot-id.js';
-/** Is `pid` a ZOMBIE (exited, awaiting reap by its parent)? `kill(pid, 0)`
- *  reports a zombie as a perfectly normal alive process — its PID is still
- *  occupied in the process table — so callers relying on that signal-0 probe
- *  alone (see `isPidAlive`) misread a dead broker as alive forever whenever
- *  its spawning process never reaps it (crouton-labs zombie-broker bug: the
- *  front door's foreground attach session parks its OWN event loop for the
- *  whole session — see `bootRoot` in runtime/boot-root.ts — so it can't process
- *  the SIGCHLD that would otherwise reap its detached broker child in real
- *  time). `ps -o stat=` reports a leading `Z` for a zombie on BOTH BSD ps
- *  (macOS) and procps-ng (Linux), so one portable probe covers both platforms
- *  without a Linux-only `/proc` special case. Best-effort: any probe failure
- *  (spawn error, no matching row, non-zero exit) reads as NOT a zombie —
- *  fail-open, matching this module's other guards; a probe failure must never
- *  be misread as proof of death (a live pid IS alive; only a positive `Z`
- *  read says otherwise). */
-function isZombie(pid) {
+/** Classify the current `ps` row for a pid. BSD ps and procps-ng both report a
+ *  leading `Z` for zombies and exit silently with empty output when no process
+ *  matches. Only a probe that could not run is unknown; that is the sole
+ *  fail-open result. */
+function psProcessState(pid) {
     try {
         const r = spawnSync('ps', ['-o', 'stat=', '-p', String(pid)], { encoding: 'utf8', timeout: 2000 });
-        if (r.status !== 0 || typeof r.stdout !== 'string')
-            return false;
-        return r.stdout.trim().charAt(0) === 'Z';
+        if (r.error != null || r.signal != null || typeof r.stdout !== 'string')
+            return 'unknown';
+        if (typeof r.stderr === 'string' && r.stderr.trim() !== '')
+            return 'unknown';
+        const stat = r.stdout.trim();
+        if (stat === '')
+            return 'gone';
+        return stat.charAt(0) === 'Z' ? 'zombie' : 'live';
     }
     catch {
-        return false;
+        return 'unknown';
     }
 }
-/** True if a process with `pid` is currently alive (signal-0 probe) AND not a
- *  zombie. `kill(pid, 0)` throws ESRCH when the process is gone; EPERM means
- *  it exists but isn't ours — still alive (a foreign process is never OUR
- *  zombie, so the `isZombie` check is skipped for that branch — see below). A
- *  null/undefined pid (legacy / never-booted) reads dead.
- *
- *  The zombie check matters because EVERY broker this module supervises is
- *  spawned `detached: true` by crtr itself (`headlessBrokerHost.launch`) — a
- *  dead broker whose spawning process hasn't reaped it yet is a zombie, and
- *  `kill(pid, 0)` alone reports it as alive, wedging the daemon's revive guard
- *  (`isPidAlive(pi_pid)`, `revive.ts`) forever: the daemon never revives an
- *  already-live-looking row, so a refreshed/crashed node whose broker zombied
- *  out under a long-lived spawning process (see `isZombie`'s doc) never comes
- *  back on its own. */
+/** True if a process with `pid` is currently alive. `kill(pid, 0)` provides the
+ *  initial existence check; EPERM means the foreign process exists. For our
+ *  processes, the later `ps` read is authoritative because it also distinguishes
+ *  zombies and processes reaped between the two probes. Only an unavailable
+ *  `ps` probe fails open to alive. A null/undefined pid reads dead. */
 export function isPidAlive(pid) {
     if (pid == null)
         return false;
@@ -59,7 +44,8 @@ export function isPidAlive(pid) {
     catch (e) {
         return e.code === 'EPERM';
     }
-    return !isZombie(pid);
+    const state = psProcessState(pid);
+    return state !== 'zombie' && state !== 'gone';
 }
 /** Matches the kernel `boot_id` UUID shape (`/proc/sys/kernel/random/boot_id`),
  *  used to tell a NEW-format identity base (a per-boot UUID) apart from a

package/dist/core/self-update.d.ts

@@ -1,3 +1,4 @@
+export declare const SELF_UPDATE_SCRIPT: string;
 export declare function currentVersion(): string;
 export declare function selfUpdate(): void;
 /** Check whether a newer crtr version is available on npm.

package/dist/core/self-update.js

@@ -15,16 +15,18 @@ const __dirname = dirname(__filename);
 // src/core/self-update.ts → up to src/ → up to pkg root
 const PKG_ROOT = join(__dirname, '..', '..');
 const PACKAGE_JSON_PATH = join(PKG_ROOT, 'package.json');
+export const SELF_UPDATE_SCRIPT = join(PKG_ROOT, 'scripts', 'self-update.mjs');
 export function currentVersion() {
     const raw = readFileSync(PACKAGE_JSON_PATH, 'utf8');
     const parsed = JSON.parse(raw);
     return parsed.version;
 }
 export function selfUpdate() {
-    const res = spawnSync('npm', ['i', '-g', '@north-light/crouter@latest'], { stdio: 'inherit' });
-    if (res.status !== 0) {
-        throw general('npm install failed');
-    }
+    const res = spawnSync(process.execPath, [SELF_UPDATE_SCRIPT], { stdio: 'inherit' });
+    if (res.error)
+        throw general(`self-update failed: ${res.error.message}`);
+    if (res.status !== 0)
+        throw general(`self-update failed (${res.status ?? res.signal ?? 'unknown'})`);
 }
 /** Check whether a newer crtr version is available on npm.
  *  Warns to stderr if network unavailable; returns {current, latest} or null if unreachable. */