@north-light/crouter 0.3.168 → 0.3.170

package/dist/commands/human/prompts.js

@@ -8,12 +8,12 @@ import { InputError } from '../../core/io.js';
 import { cliClient } from '../api-client.js';
 import { nodeDir } from '../../core/canvas/paths.js';
 import { mkdirSync, existsSync } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { randomBytes, randomUUID } from 'node:crypto';
 import { tmuxServerReachable } from '../../core/spawn.js';
 import { BrokerClient, BrokerUnavailableError } from '../../core/broker-client/index.js';
 import { markStopSignal } from '../../core/runtime/stop-signals.js';
-import { validateDeck, notifyDeck, atomicWriteJson, submitDeck, submitReview, display, } from '@crouton-kit/humanloop';
+import { validateDeck, resolveDeckBodyPaths, notifyDeck, atomicWriteJson, submitDeck, submitReview, display, } from '@crouton-kit/humanloop';
 import { BODY_PATH_CONTRACT, DECK_SCHEMA_HINT, registerCrouterRoot, resolveMaxPanes } from './shared.js';
 import { inboxOpenInstruction, inboxPopupHint } from '../../core/keybindings/index.js';
 /** The asking node's id, or null when run from a bare shell (no parent to route to). */
@@ -54,14 +54,22 @@ function requireSubtitle(subtitle, field = 'subtitle') {
         next: 'Write one plain-English sentence stating the decision, recommendation or status, and stakes.',
     });
 }
-function validateTitledDeck(input) {
+function validateTitledDeck(input, deckDirectory) {
     const title = typeof input === 'object' && input !== null
         ? input.title
         : undefined;
     if (typeof title !== 'string' || title.trim() === '') {
         throw new Error('deck title is required');
     }
-    return validateDeck(input);
+    const deck = validateDeck(input);
+    if (deckDirectory === undefined)
+        return deck;
+    for (const interaction of deck.interactions) {
+        if (interaction.bodyPath !== undefined && isAbsolute(interaction.bodyPath)) {
+            throw new Error('bodyPath must be relative to the deck JSON; absolute paths are unsupported');
+        }
+    }
+    return resolveDeckBodyPaths(deck, deckDirectory);
 }
 function buildHumanAskDeck(title, subtitle, question) {
     return validateTitledDeck({
@@ -172,7 +180,7 @@ export const humanAsk = defineLeaf({
             `Returns immediately; nothing opens on screen. The human answers from the inbox popup (${inboxPopupHint()}) on their own time.`,
         ],
     },
-    run: async (input) => {
+    run: async (input, context) => {
         // Optional stdin reaches the leaf as an empty string when omitted, including
         // when --context-file is supplied. Keep the raw non-empty bytes untouched.
         const titleRaw = input['title'];
@@ -182,6 +190,7 @@ export const humanAsk = defineLeaf({
         const subtitleRaw = input['subtitle'];
         const subtitle = typeof subtitleRaw === 'string' && subtitleRaw.trim() !== '' ? subtitleRaw.trim() : undefined;
         const deckInput = input['deck'];
+        const deckPath = context?.contextFilePaths.get('deck');
         if (deckInput !== undefined && (question !== undefined || titleRaw !== undefined || subtitleRaw !== undefined)) {
             throw new InputError({
                 error: 'bad_invocation',
@@ -205,7 +214,7 @@ export const humanAsk = defineLeaf({
                 deck = buildHumanAskDeck(simpleAsk.title, simpleAsk.subtitle, simpleAsk.question);
             }
             else {
-                deck = validateTitledDeck(deckInput);
+                deck = validateTitledDeck(deckInput, deckPath === undefined ? undefined : dirname(deckPath));
             }
             deck = canonicalizeAskKinds(deck);
         }

package/dist/commands/sys/daemon.js

@@ -85,6 +85,7 @@ const daemonRestart = defineLeaf({
         outputKind: 'object',
         effects: [
             'The daemon acknowledges immediately, then after a short grace tears its whole broker fleet down, releases its claim, spawns a successor on the runtime generation currently selected, and exits.',
+            'Each torn-down broker hands its foreground bash commands to the file-backed background job system; they keep running and report completion by urgent inbox message.',
             'Every node it tore down — including the caller — is resumed by the successor through the ordinary startup recovery sweep.',
             'The calling process is killed as part of that teardown, AFTER this result is returned.',
         ],

package/dist/core/__tests__/human-deliver.test.js

@@ -16,17 +16,20 @@ import { test, describe, before, after, beforeEach, afterEach } from 'node:test'
 import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, writeFileSync, realpathSync, readFileSync, existsSync, symlinkSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { dirname, join, basename } from 'node:path';
+import { dirname, join, resolve, basename } from 'node:path';
+import { Readable } from 'node:stream';
 import { registerInboxRoot, submitDeck, validateDeck, claimTicket, completeDeck, cancelTicket, readTicketResult, atomicWriteJson, } from '@crouton-kit/humanloop';
 import { spawnNode } from '../runtime/nodes.js';
 import { getNode, listNodes, closeDb } from '../canvas/index.js';
 import { readInboxSince } from '../feed/inbox.js';
 import { humanAsk, humanReview, humanNotify } from '../../commands/human/prompts.js';
+import { runCli } from '../command.js';
 import { resolveRef } from '../canvas/history.js';
 import { humanDeliver } from '../../commands/human/queue.js';
 import { createApiServer } from '../../daemon/api/server.js';
 import { trustedCrouterVisualHandler } from '../../daemon/api/handlers/human.js';
-import { apiSocketPath } from '../canvas/paths.js';
+import { apiSocketPath, nodeDir } from '../canvas/paths.js';
+import { resolveRoot } from '../../build-root.js';
 // ---------------------------------------------------------------------------
 // Isolated environment
 // ---------------------------------------------------------------------------
@@ -57,6 +60,28 @@ const ISO = '2026-07-10T12:00:00.000Z';
 function benignHandler() {
     return { command: process.execPath, args: ['-e', ''] };
 }
+async function withPipedStdin(body, fn) {
+    const original = process.stdin;
+    const stdin = Readable.from([Buffer.from(body)]);
+    Object.defineProperty(stdin, 'isTTY', { value: false, configurable: true });
+    Object.defineProperty(process, 'stdin', { value: stdin, configurable: true });
+    try {
+        return await fn();
+    }
+    finally {
+        Object.defineProperty(process, 'stdin', { value: original, configurable: true });
+    }
+}
+async function withMutedStdout(fn) {
+    const originalWrite = process.stdout.write;
+    process.stdout.write = (() => true);
+    try {
+        return await fn();
+    }
+    finally {
+        process.stdout.write = originalWrite;
+    }
+}
 /** Register `dir` (created fresh) as an owner-'crouter' root and return its
  *  canonical path. */
 function registerRoot(dir) {
@@ -172,6 +197,41 @@ describe('enqueue is producer-only', () => {
         }));
         const structuredDeck = JSON.parse(readFileSync(join(structured['dir'], 'deck.json'), 'utf8'));
         assert.deepEqual(structuredDeck.interactions.map((interaction) => interaction.kind), ['decision', 'context']);
+        const deckDir = mkdtempSync(join(tmpdir(), 'crtr-context-file-deck-'));
+        assert.notEqual(resolve(process.cwd()), deckDir, 'the CLI caller cwd must differ from the deck directory');
+        const deckPath = join(deckDir, 'deck.json');
+        writeFileSync(join(deckDir, 'body.md'), 'The body came from beside the deck JSON.');
+        writeFileSync(deckPath, JSON.stringify({
+            title: 'Context file body',
+            interactions: [{
+                    id: 'decision',
+                    title: 'Use the deck',
+                    subtitle: 'Use the deck body so the person can decide with its context.',
+                    bodyPath: 'body.md',
+                    options: [{ id: 'yes', label: 'Yes' }],
+                }],
+        }));
+        const nodesBeforeContextFile = new Set(listNodes().map((node) => node.node_id));
+        await withMutedStdout(() => withPipedStdin('', async () => {
+            await runCli(await resolveRoot('human'), ['node', 'crtr', 'human', 'ask', '--context-file', deckPath]);
+        }));
+        const contextFileBridge = listNodes().find((node) => !nodesBeforeContextFile.has(node.node_id));
+        assert.ok(contextFileBridge, 'the real CLI invocation created a human bridge');
+        const contextFileDeck = JSON.parse(readFileSync(join(nodeDir(contextFileBridge.node_id), 'deck.json'), 'utf8'));
+        assert.equal(contextFileDeck.interactions[0]?.body, 'The body came from beside the deck JSON.');
+        assert.equal(contextFileDeck.interactions[0]?.bodyPath, undefined);
+        await assert.rejects(() => humanAsk.run({
+            deck: {
+                title: 'Absolute path',
+                interactions: [{
+                        id: 'decision',
+                        title: 'Reject absolute path',
+                        subtitle: 'Reject the invalid path so the documented deck boundary remains intact.',
+                        bodyPath: join(deckDir, 'body.md'),
+                        options: [{ id: 'yes', label: 'Yes' }],
+                    }],
+            },
+        }, { providedParams: new Set(['deck']), contextFilePaths: new Map([['deck', deckPath]]) }), /absolute paths are unsupported/);
         const rc = JSON.parse(readFileSync(join(r['dir'], 'run.json'), 'utf8'));
         assert.equal(rc['mode'], 'ask');
         assert.equal(rc['job_id'], r['job_id']);

package/dist/core/__tests__/revive.test.js

@@ -35,6 +35,7 @@ import { fileURLToPath } from 'node:url';
 import { spawn, spawnSync } from 'node:child_process';
 import { createNode, getNode, subscribe, updateNode, clearPid } from '../canvas/canvas.js';
 import { armFollowUpWork } from '../canvas/human-work-outbox.js';
+import { armCron, hasPendingCancelOnWakeCron } from '../canvas/crons.js';
 import { readInboxSince } from '../feed/inbox.js';
 import { closeDb } from '../canvas/db.js';
 import { buildPiArgv, CANVAS_EXTENSIONS } from '../runtime/launch.js';
@@ -346,6 +347,53 @@ test('reviveNode PROCEEDS when the node has NO fleet entry — cycle counter bum
         await h.dispose();
     }
 });
+// ---------------------------------------------------------------------------
+// BUG LOCKED — a recovery relaunch must not eat the node's armed deadline.
+// A node armed `crtr node wait deadline` and dormed; its broker then exited and
+// the daemon respawned it (fleet.#respawn → reviveNode). reviveNode used to
+// cancel every cancel-on-wake cron unconditionally, so the deadline vanished
+// with nothing having woken the node and the wait could never settle. A wake
+// (inbox delivery, attach, explicit revive) still consumes it.
+// ---------------------------------------------------------------------------
+function armDeadline(anchor, cronId) {
+    armCron({
+        cron_id: cronId,
+        name: `deadline:${anchor}`,
+        created_by: anchor,
+        command: 'true',
+        fire_at: new Date(Date.now() + 3_600_000).toISOString(),
+        recur: null,
+        tz: null,
+        expires_at: null,
+        anchor_node: anchor,
+        cancel_on_wake: true,
+        cwd: home,
+        env_json: null,
+        profile: null,
+        scope: 'profile',
+        run_timeout_s: 300,
+        overlap: 'skip',
+        on_output: 'on-failure',
+        sink: '',
+        tier: 'normal',
+    });
+}
+test('a recovery relaunch keeps the armed deadline; a wake revive consumes it', async () => {
+    const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-deadline' });
+    try {
+        const recovered = h.fabricateBrokerNode({ status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'uuid-1' });
+        armDeadline(recovered, 'cron-recovery');
+        reviveNode(recovered, { resume: true, recovery: true });
+        assert.equal(hasPendingCancelOnWakeCron(recovered), true, 'the daemon replacing a dead broker is not a wake — the deadline survives so the wait can still settle');
+        const woken = h.fabricateBrokerNode({ status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'uuid-2' });
+        armDeadline(woken, 'cron-wake');
+        reviveNode(woken, { resume: true });
+        assert.equal(hasPendingCancelOnWakeCron(woken), false, 'a wake revive won the race and cancels the deadline');
+    }
+    finally {
+        await h.dispose();
+    }
+});
 test('reviveNode fresh-fallback clears the stale session identity (Major-3: no phantom stranded-relaunch)', async () => {
     const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-freshfb' });
     try {

package/dist/core/bash-jobs.d.ts

@@ -4,7 +4,9 @@ export interface BashJobPaths {
     cmdSh: string;
     jobLog: string;
     jobExit: string;
+    jobRun: string;
     jobBg: string;
+    jobDone: string;
     /** Process-group id of the job's detached supervisor, written at spawn. It is
      * what makes a job stoppable from outside the agent that started it (the
      * Inspector's cancel) — without it on disk, only the agent's own handoff
@@ -42,25 +44,22 @@ export interface BashJobStatus {
     logPath: string;
 }
 /** Every live backgrounded bash job for this node — job.bg present, job.exit
- * absent — whether handed off by the menu or auto-backgrounded at the valve's
- * deadline. Read-only; never mutates. Distinct from (and shares no code path
- * with) the foreground-only `runningBashJobs` above: that scanner deliberately
- * EXCLUDES job.bg, this one REQUIRES it, so reusing one for the other would
- * corrupt foreground-admission semantics. Skips malformed/partially-written
+ * absent — whether handed off by the menu, the valve deadline, or broker
+ * termination. Read-only; never mutates. Skips malformed/partially-written
  * directories. Returns oldest-first by startedAtMs. */
 export declare function activeBackgroundBashJobs(contextDir: string): BashJobStatus[];
-/** The start time (ms epoch) of the OLDEST still-foreground bash command for
+export type BackgroundBashJobResult = 'backgrounded' | 'already-backgrounded' | 'finished' | 'missing';
+/** Atomically hand one foreground job to its detached supervisor. The rename
+ * is the ownership decision: exactly one caller can move job.run to job.bg,
+ * while the supervisor races to move the same source to job.done. */
+export declare function backgroundBashJob(paths: BashJobPaths): BackgroundBashJobResult;
+/** The start time (ms epoch) of the oldest still-foreground bash command for
  * this node, or undefined when none is running. This is the authoritative
- * source for the attach viewer's R4 "background it" footer hint: it reads the
- * exact same on-disk contract the valve writes (a job directory exists with
- * no job.bg and no job.exit while the command is running in the foreground,
- * and the valve deletes the directory the moment the command finishes or is
- * aborted — see canvas-bash-valve.ts), so a fresh or reconnected attach (which
- * has no memory of a broker-relayed tool-execution event) sees exactly what's
- * really running, and a viewer never needs its own call-id tracking that could
- * go stale across a broker/session replacement. */
+ * source for the attach viewer's background hint: a fresh or reconnected
+ * attach reads the same job.run state that backgrounding and completion race
+ * to claim, without viewer-local call tracking that can go stale. */
 export declare function oldestRunningBashJobStartedAtMs(contextDir: string): number | undefined;
-/** Request immediate handoff for every bash command still waiting on pi. The
- * valve observes job.bg within one poll, resolves the tool call, and leaves its
- * detached supervisor to notify the node when the real command exits. */
+/** Request immediate handoff for every bash command still waiting on pi. Only
+ * the caller that wins the job.run → job.bg rename reports the job as handed
+ * off; another backgrounder or the foreground-completion path may win the race. */
 export declare function backgroundRunningBashJobs(contextDir: string): BashJobPaths[];

package/dist/core/bash-jobs.js

@@ -1,9 +1,9 @@
-// File-backed control plane for bash commands that have been handed off by the
-// canvas bash valve. The valve starts every command in one of these directories;
-// the prefix menu requests backgrounding by creating job.bg. Keeping that signal
-// on disk means the command can outlive its pi process and still report its exit.
+// File-backed control plane for bash commands started by the canvas bash valve.
+// Every foreground command owns job.run; backgrounding atomically renames it to
+// job.bg, while foreground completion renames it to job.done. The detached
+// supervisor can therefore outlive pi and still decide whether to report exit.
 import { randomBytes } from 'node:crypto';
-import { closeSync, existsSync, openSync, readdirSync, readFileSync, readSync, statSync, writeFileSync } from 'node:fs';
+import { closeSync, existsSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 export function bashJobsDir(contextDir) {
     return join(contextDir, 'jobs');
@@ -16,7 +16,9 @@ export function bashJobPaths(contextDir, jobId) {
         cmdSh: join(dir, 'cmd.sh'),
         jobLog: join(dir, 'job.log'),
         jobExit: join(dir, 'job.exit'),
+        jobRun: join(dir, 'job.run'),
         jobBg: join(dir, 'job.bg'),
+        jobDone: join(dir, 'job.done'),
         jobPgid: join(dir, 'job.pgid'),
     };
 }
@@ -94,11 +96,8 @@ export function formatBashElapsed(ms) {
     return `${hours}h ${String(minutes).padStart(2, '0')}m`;
 }
 /** Every live backgrounded bash job for this node — job.bg present, job.exit
- * absent — whether handed off by the menu or auto-backgrounded at the valve's
- * deadline. Read-only; never mutates. Distinct from (and shares no code path
- * with) the foreground-only `runningBashJobs` above: that scanner deliberately
- * EXCLUDES job.bg, this one REQUIRES it, so reusing one for the other would
- * corrupt foreground-admission semantics. Skips malformed/partially-written
+ * absent — whether handed off by the menu, the valve deadline, or broker
+ * termination. Read-only; never mutates. Skips malformed/partially-written
  * directories. Returns oldest-first by startedAtMs. */
 export function activeBackgroundBashJobs(contextDir) {
     let entries;
@@ -127,9 +126,27 @@ export function activeBackgroundBashJobs(contextDir) {
     }
     return jobs.sort((a, b) => a.startedAtMs - b.startedAtMs);
 }
-/** Every still-foreground bash command for this node. A completed command has
- * job.exit; an already-backgrounded one has job.bg and must not be selected a
- * second time. Invalid or concurrently-removed directories are ignored. */
+/** Atomically hand one foreground job to its detached supervisor. The rename
+ * is the ownership decision: exactly one caller can move job.run to job.bg,
+ * while the supervisor races to move the same source to job.done. */
+export function backgroundBashJob(paths) {
+    try {
+        renameSync(paths.jobRun, paths.jobBg);
+        return 'backgrounded';
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+        if (existsSync(paths.jobBg))
+            return 'already-backgrounded';
+        if (existsSync(paths.jobDone))
+            return 'finished';
+        return 'missing';
+    }
+}
+/** Every still-foreground bash command for this node. job.run is the sole live
+ * foreground state; a handoff or foreground completion atomically removes it.
+ * Invalid or concurrently-removed directories are ignored. */
 function runningBashJobs(contextDir) {
     let entries;
     try {
@@ -140,21 +157,16 @@ function runningBashJobs(contextDir) {
     }
     return entries.flatMap((jobId) => {
         const paths = bashJobPaths(contextDir, jobId);
-        return existsSync(paths.cmdSh) && existsSync(paths.jobLog) && !existsSync(paths.jobExit) && !existsSync(paths.jobBg)
+        return existsSync(paths.cmdSh) && existsSync(paths.jobLog) && existsSync(paths.jobRun)
             ? [paths]
             : [];
     });
 }
-/** The start time (ms epoch) of the OLDEST still-foreground bash command for
+/** The start time (ms epoch) of the oldest still-foreground bash command for
  * this node, or undefined when none is running. This is the authoritative
- * source for the attach viewer's R4 "background it" footer hint: it reads the
- * exact same on-disk contract the valve writes (a job directory exists with
- * no job.bg and no job.exit while the command is running in the foreground,
- * and the valve deletes the directory the moment the command finishes or is
- * aborted — see canvas-bash-valve.ts), so a fresh or reconnected attach (which
- * has no memory of a broker-relayed tool-execution event) sees exactly what's
- * really running, and a viewer never needs its own call-id tracking that could
- * go stale across a broker/session replacement. */
+ * source for the attach viewer's background hint: a fresh or reconnected
+ * attach reads the same job.run state that backgrounding and completion race
+ * to claim, without viewer-local call tracking that can go stale. */
 export function oldestRunningBashJobStartedAtMs(contextDir) {
     let oldest;
     for (const paths of runningBashJobs(contextDir)) {
@@ -166,25 +178,14 @@ export function oldestRunningBashJobStartedAtMs(contextDir) {
     }
     return oldest;
 }
-/** Request immediate handoff for every bash command still waiting on pi. The
- * valve observes job.bg within one poll, resolves the tool call, and leaves its
- * detached supervisor to notify the node when the real command exits. */
+/** Request immediate handoff for every bash command still waiting on pi. Only
+ * the caller that wins the job.run → job.bg rename reports the job as handed
+ * off; another backgrounder or the foreground-completion path may win the race. */
 export function backgroundRunningBashJobs(contextDir) {
     const backgrounded = [];
     for (const paths of runningBashJobs(contextDir)) {
-        try {
-            // A job may exit or be claimed by another prefix press between the scan
-            // and this write. Recheck the two terminal/control files so that stale
-            // candidates never masquerade as a successful handoff.
-            if (existsSync(paths.jobExit) || existsSync(paths.jobBg))
-                continue;
-            writeFileSync(paths.jobBg, '');
+        if (backgroundBashJob(paths) === 'backgrounded')
             backgrounded.push(paths);
-        }
-        catch {
-            // The valve owns cleanup; a concurrently removed directory is simply no
-            // longer a running command to hand off.
-        }
     }
     return backgrounded;
 }

package/dist/core/canvas/__tests__/render-remote.test.js

@@ -102,6 +102,31 @@ test('dashboardRowsAllFromSource shows a node watched through its live broker',
     const rows = await dashboardRowsAllFromSource(source);
     assert.equal(rows[0]?.viewed, true);
 });
+test('enrichRowsFromSource serializes a full dashboard source read', async () => {
+    const nodeRows = ['a', 'b', 'c'].map(row);
+    let inFlight = 0;
+    let maxInFlight = 0;
+    const source = {
+        getNode: async (id) => {
+            inFlight++;
+            maxInFlight = Math.max(maxInFlight, inFlight);
+            await new Promise((resolve) => setImmediate(resolve));
+            inFlight--;
+            return meta(id);
+        },
+        getRow: async () => null,
+        listNodes: async () => nodeRows,
+        subscriptionsOf: async () => [],
+        subscribersOf: async () => [],
+        view: async () => [],
+        ticketCountsForView: async () => ({}),
+        hasActiveLiveSubscription: async () => false,
+    };
+    const rows = await dashboardRowsAllFromSource(source);
+    await enrichRowsFromSource(source, rows);
+    assert.equal(maxInFlight, 1);
+    assert.deepEqual(rows.map((entry) => entry.name), ['a', 'b', 'c']);
+});
 let home;
 let localCwd;
 let sessionFile;

package/dist/core/canvas/crons.d.ts

@@ -160,8 +160,9 @@ export declare function setCronLastOutputHash(cron_id: string, hash: string): vo
  *  terminal node that stopped without finishing. */
 export declare function hasPendingCancelOnWakeCron(anchor_node: string): boolean;
 /** DELETE every cancel-on-wake cron anchored to this node — the deadline rule.
- *  Two seams call it: reviveNode on every revive-for-any-reason (the wake won
- *  the race), and the `finish`/`cancel` lifecycle transitions (the wait ended
+ *  Two seams call it: reviveNode on a WAKE — every revive except a recovery
+ *  relaunch, which only replaces a dead broker instance and leaves the wait
+ *  open (the wake won the race), and the `finish`/`cancel` lifecycle transitions (the wait ended
  *  with the node, so its deadline must not fire against a finalized or closed
  *  row). Standing declarative crons are untouched — only cancel-on-wake rows.
  *  Kills any in-flight

package/dist/core/canvas/crons.js

@@ -219,8 +219,9 @@ export function hasPendingCancelOnWakeCron(anchor_node) {
         .get(anchor_node) !== undefined);
 }
 /** DELETE every cancel-on-wake cron anchored to this node — the deadline rule.
- *  Two seams call it: reviveNode on every revive-for-any-reason (the wake won
- *  the race), and the `finish`/`cancel` lifecycle transitions (the wait ended
+ *  Two seams call it: reviveNode on a WAKE — every revive except a recovery
+ *  relaunch, which only replaces a dead broker instance and leaves the wait
+ *  open (the wake won the race), and the `finish`/`cancel` lifecycle transitions (the wait ended
  *  with the node, so its deadline must not fire against a finalized or closed
  *  row). Standing declarative crons are untouched — only cancel-on-wake rows.
  *  Kills any in-flight

package/dist/core/canvas/render-source.js

@@ -430,14 +430,18 @@ export async function enrichRowsFromSource(source, rows, asks) {
         return;
     const remote = source instanceof RemoteCanvasSource;
     const askMap = asks ?? {};
-    await Promise.all(todo.map(async (row) => {
+    // A full dashboard may contain thousands of rows. Keep source reads serial:
+    // ApiCanvasSource turns each into a unix-socket request, and an unbounded
+    // Promise.all can overflow crtrd's accept backlog then spuriously trigger
+    // the client's cold-daemon path even though the daemon is still running.
+    for (const row of todo) {
         const meta = await source.getNode(row.node_id);
         if (meta !== null)
             row.name = fullName(meta);
         row.ctx_tokens = remote ? 0 : (readNodeTelemetry(row.node_id).tokens_in ?? 0);
         row.asks = askMap[row.node_id] ?? 0;
         row.enriched = true;
-    }));
+    }
 }
 /** goal (initial-prompt.md) and session parts are local disk reads — suppressed
  *  to undefined for a remote source. */

package/dist/core/command.d.ts

@@ -12,6 +12,11 @@ export interface LeafRunContext {
      *  as a positional argument, or explicitly passed; absence means TTY with no
      *  pipe (truly absent). */
     readonly providedParams: ReadonlySet<string>;
+    /** Absolute source paths for JSON values supplied through `--context-file`,
+     *  keyed by their camel-cased parameter name. The parsed JSON remains the
+     *  leaf input; this metadata preserves its source directory for values that
+     *  reference adjacent files. */
+    readonly contextFilePaths: ReadonlyMap<string, string>;
 }
 /** Opt-in flag that surfaces a node as an editor slash command (a pi prompt
  *  template / Claude Code command). When set, the bootstrap auto-writes a
@@ -149,6 +154,9 @@ export interface ParseArgvOptions {
      *  Called once with a ReadonlySet of parameter names that were supplied by
      *  the caller (distinct from defaulted or missing values). */
     onProvidedParams?: (provided: ReadonlySet<string>) => void;
+    /** Optional collector for absolute source paths of JSON values supplied via
+     *  `--context-file`, keyed by their camel-cased parameter name. */
+    onContextFilePaths?: (paths: ReadonlyMap<string, string>) => void;
     /** The walked command path (e.g. `['push','final']`), supplied by the
      *  dispatcher. Used only to name the exact leaf in a schema-class error's
      *  `Next:` line, which mandates reading that leaf's `-h`. */

package/dist/core/command.js

@@ -14,6 +14,7 @@ import { readFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { constants as osConstants } from 'node:os';
 import { isatty } from 'node:tty';
+import { resolve } from 'node:path';
 // ---------------------------------------------------------------------------
 // Factory functions
 // ---------------------------------------------------------------------------
@@ -268,6 +269,7 @@ function flagNameToKey(name) {
 export async function parseArgv(params, tokens, options) {
     const result = {};
     const provided = new Set(); // Track explicitly-provided parameter names
+    const contextFilePaths = new Map();
     // Index params by kind for quick lookup
     const positionalParam = params.find((p) => p.kind === 'positional');
     const stdinParam = params.find((p) => p.kind === 'stdin');
@@ -332,6 +334,7 @@ export async function parseArgv(params, tokens, options) {
                 }
                 const contextFileKey = flagNameToKey(contextFileParam.name);
                 result[contextFileKey] = parsed;
+                contextFilePaths.set(contextFileKey, resolve(pathVal));
                 provided.add(contextFileKey);
                 i++;
                 continue;
@@ -539,6 +542,9 @@ export async function parseArgv(params, tokens, options) {
     if (options?.onProvidedParams !== undefined) {
         options.onProvidedParams(provided);
     }
+    if (options?.onContextFilePaths !== undefined) {
+        options.onContextFilePaths(contextFilePaths);
+    }
     return result;
 }
 export async function runCli(root, argv, options) {
@@ -618,13 +624,17 @@ export async function runCli(root, argv, options) {
         const leaf = node;
         const params = leaf.help.params !== undefined ? leaf.help.params : [];
         let providedParams = new Set();
+        let contextFilePaths = new Map();
         const input = await parseArgv(params, remaining, {
             leafPath: path,
             onProvidedParams: (provided) => {
                 providedParams = provided;
             },
+            onContextFilePaths: (paths) => {
+                contextFilePaths = paths;
+            },
         });
-        const context = { providedParams };
+        const context = { providedParams, contextFilePaths };
         const result = await operationIdContext.fresh(() => leaf.run(input, context));
         if (result !== undefined && result !== null) {
             if (isJsonOutput()) {

package/dist/core/runtime/revive-all.js

@@ -95,7 +95,9 @@ export function reviveAll() {
     const result = { revived: [], failed: [] };
     for (const meta of listDisconnected()) {
         try {
-            reviveNode(meta.node_id, { resume: true });
+            // Reconnecting a disconnected broker is recovery, not a wake — a node
+            // waiting on an armed deadline keeps it across the sweep.
+            reviveNode(meta.node_id, { resume: true, recovery: true });
             result.revived.push(meta.node_id);
         }
         catch (err) {

package/dist/core/runtime/revive.d.ts

@@ -49,10 +49,17 @@ export interface ReviveResult {
 /** Relaunch `nodeId`'s broker engine from its persisted recipe and update canvas
  *  meta. Opens no viewer (engine-only).
  *
+ *  `recovery: true` marks a launch that only replaces a broker instance which
+ *  died or was torn down — the daemon's respawn after a broker exit, and the
+ *  `reviveAll` sweep over disconnected nodes. Nothing external arrived for the
+ *  node, so such a launch is NOT a wake and does not consume the node's armed
+ *  deadline (see the cancelCronsOnWake call below).
+ *
  *  Throws if the node does not exist. All other failures propagate as-is —
  *  callers (daemon, command) decide how to handle.
  */
 export declare function reviveNode(nodeId: string, opts: {
     resume: boolean;
     wakeReason?: ReviveWakeReason;
+    recovery?: boolean;
 }): ReviveResult;

package/dist/core/runtime/revive.js

@@ -92,6 +92,12 @@ function isUnstartedBirth(nodeId) {
 /** Relaunch `nodeId`'s broker engine from its persisted recipe and update canvas
  *  meta. Opens no viewer (engine-only).
  *
+ *  `recovery: true` marks a launch that only replaces a broker instance which
+ *  died or was torn down — the daemon's respawn after a broker exit, and the
+ *  `reviveAll` sweep over disconnected nodes. Nothing external arrived for the
+ *  node, so such a launch is NOT a wake and does not consume the node's armed
+ *  deadline (see the cancelCronsOnWake call below).
+ *
  *  Throws if the node does not exist. All other failures propagate as-is —
  *  callers (daemon, command) decide how to handle.
  */
@@ -309,9 +315,15 @@ export function reviveNode(nodeId, opts) {
     // unchecked result, is what scopes a later diagnostic read to this attempt.
     clearFault(nodeId);
     const bootFault = beginBootFaultAttempt(nodeId);
-    // A cron armed --cancel-on-wake belongs to the dormancy being left, so any
-    // revive of its anchor deletes it.
-    cancelCronsOnWake(nodeId);
+    // A cron armed --cancel-on-wake belongs to the dormancy being left, so a WAKE
+    // of its anchor deletes it — an inbox delivery, an attach, an explicit
+    // revive. A recovery relaunch is not a wake: the broker instance died or was
+    // torn down and the daemon is putting the same waiting node back on its feet,
+    // with nothing external having arrived. The wait the deadline bounds is still
+    // open, so the deadline survives — the same rule lifecycle.ts applies to the
+    // `crash` transition (a deadline MUST survive instance death).
+    if (opts.recovery !== true)
+        cancelCronsOnWake(nodeId);
     let launched;
     try {
         launched = headlessBrokerHost.launch(nodeId, inv, {