@north-light/crouter 0.3.170 → 0.3.171

package/dist/clients/web/dev-server.d.ts

@@ -3,5 +3,8 @@ import type { ViteDevServer } from 'vite';
 /** Create a Vite dev server in middleware mode, HMR bound to `httpServer`.
  *  Mirrors the old `view serve` resolve setup so the shell's bare imports
  *  (react, the `@north-light/crouter/web` self-subpath) resolve from the
- *  generated/shell root. Lazily imports vite so the shipped path never loads it. */
+ *  generated/shell root. It loads the shell's Vite config rather than duplicating
+ *  its plugins: that config supplies the PWA virtual-module resolver as well as
+ *  the production build settings. Lazily imports vite so the shipped path never
+ *  loads it. */
 export declare function createDevServer(httpServer: HttpServer): Promise<ViteDevServer>;

package/dist/clients/web/dev-server.js

@@ -24,30 +24,19 @@ function resolveShellRoot(packageRoot) {
 /** Create a Vite dev server in middleware mode, HMR bound to `httpServer`.
  *  Mirrors the old `view serve` resolve setup so the shell's bare imports
  *  (react, the `@north-light/crouter/web` self-subpath) resolve from the
- *  generated/shell root. Lazily imports vite so the shipped path never loads it. */
+ *  generated/shell root. It loads the shell's Vite config rather than duplicating
+ *  its plugins: that config supplies the PWA virtual-module resolver as well as
+ *  the production build settings. Lazily imports vite so the shipped path never
+ *  loads it. */
 export async function createDevServer(httpServer) {
     const packageRoot = resolve(HERE, '../../..');
-    const nodeModules = join(packageRoot, 'node_modules');
     const shellRoot = resolveShellRoot(packageRoot);
     const { createServer } = await import('vite');
-    const react = (await import('@vitejs/plugin-react')).default;
-    const tailwindcss = (await import('@tailwindcss/vite')).default;
     return createServer({
-        configFile: false,
-        root: shellRoot,
-        plugins: [react(), tailwindcss()],
-        appType: 'spa',
-        resolve: {
-            alias: {
-                react: join(nodeModules, 'react'),
-                'react-dom': join(nodeModules, 'react-dom'),
-                '@': shellRoot,
-                // The crtr web runtime is a self-subpath of crouter's own package;
-                // pin it to the built barrel so the shell can import it from any root.
-                '@north-light/crouter/web': join(packageRoot, 'dist', 'web', 'index.js'),
-            },
-            dedupe: ['react', 'react-dom'],
-        },
+        configFile: join(shellRoot, 'vite.config.ts'),
+        // The integrated middleware already owns /node, /v1, and /__crtr. The
+        // shell config uses this mode to omit its standalone-server proxies.
+        mode: 'middleware',
         server: {
             middlewareMode: true,
             // Share our HTTP server for HMR; server.ts's upgrade handler hands every

package/dist/clients/web/web-cmd.js

@@ -100,7 +100,7 @@ const webServeLeaf = defineLeaf({
         const open = input['open'] ?? false;
         const dev = input['dev'] ?? false;
         const server = await startWebServer({ port, host, token, dev });
-        const nodeUrlShape = `${server.url}/node/<id>`;
+        const nodeUrlShape = `${server.url}/nodes/<id>`;
         const browserUrl = token !== undefined ? `${server.url}?token=${encodeURIComponent(token)}` : server.url;
         process.stdout.write(`crtr surface web serving on ${server.url}${dev ? ' (--dev: Vite middleware)' : ''}\n` +
             `  open a node:  ${nodeUrlShape}\n` +

package/dist/commands/human/prompts.js

@@ -13,7 +13,8 @@ import { randomBytes, randomUUID } from 'node:crypto';
 import { tmuxServerReachable } from '../../core/spawn.js';
 import { BrokerClient, BrokerUnavailableError } from '../../core/broker-client/index.js';
 import { markStopSignal } from '../../core/runtime/stop-signals.js';
-import { validateDeck, resolveDeckBodyPaths, notifyDeck, atomicWriteJson, submitDeck, submitReview, display, } from '@crouton-kit/humanloop';
+import { validateDeck, resolveDeckBodyPaths, notifyDeck, atomicWriteJson, submitDeck, submitReview, } from '@crouton-kit/humanloop';
+import { display } from '../../core/termrender/display.js';
 import { BODY_PATH_CONTRACT, DECK_SCHEMA_HINT, registerCrouterRoot, resolveMaxPanes } from './shared.js';
 import { inboxOpenInstruction, inboxPopupHint } from '../../core/keybindings/index.js';
 /** The asking node's id, or null when run from a bare shell (no parent to route to). */

package/dist/commands/pkg/plugin-manage.js

@@ -1,19 +1,19 @@
-import { join, resolve, isAbsolute } from 'node:path';
-import { renameSync } from 'node:fs';
+import { join, resolve, isAbsolute, sep } from 'node:path';
+import { renameSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { defineLeaf } from '../../core/command.js';
-import { CrtrError, notFound, usage, general, network } from '../../core/errors.js';
+import { notFound, usage, general, network } from '../../core/errors.js';
 import { findMarketplaceByName, findPluginByName, listAllPlugins } from '../../core/resolver.js';
 import { pluginsDir, ensureProjectScopeRoot, userScopeRoot, resolveScopeArg, projectScopeRoot, requireScopeRoot, } from '../../core/scope.js';
 import { updateConfig, updateState, ensureScopeInitialized } from '../../core/config.js';
 import { pathExists, ensureDir, removePath, nowIso, linkOrCopy, isSymlink, atomicWriteJson } from '../../core/fs-utils.js';
 import { clone, pull, deriveNameFromUrl, currentSha, isGitRepo } from '../../core/git.js';
-import { pluginManifestPath, readMarketplaceManifest, readPluginManifest } from '../../core/manifest.js';
+import { readMarketplaceManifest, readPluginManifest } from '../../core/manifest.js';
 import { validatePluginCommands, validateEffectiveCommandPlugins } from '../../core/command-plugins/discovery.js';
 import { normalizeEndpoint, validateEndpoint, validateHttpPluginTransport } from '../../core/command-plugins/endpoint.js';
-import { resolveHttpPluginManifestStore, writeHttpPluginManifest } from '../../core/command-plugins/store.js';
-import { fetchHttpPluginManifest, refreshHttpPlugin } from '../../core/command-plugins/transport/http-fetch.js';
+import { validatePluginBundle } from '../../core/command-plugins/bundle.js';
+import { fetchHttpPluginBundle } from '../../core/command-plugins/transport/http-fetch.js';
 import { SUBTREE_NAMES } from '../../build-root.js';
-import { ExitCode } from '../../types.js';
 import { isGitUrl, setPluginEnabled, resolveInstallScope } from './shared.js';
 /** Validate a just-installed/updated plugin's command manifest, if it declares
  *  one. Returns undefined for plugins without a `commands` pointer. Never
@@ -32,66 +32,137 @@ function commandReport(name, scope) {
     return { mounts: v.contributions.map((c) => c.node.name), issues: v.issues };
 }
 const PLUGIN_NAME_RE = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
-function unsafeHttpManifestPath(name, commands) {
-    throw new CrtrError('command_path_unsafe', `HTTP plugin "${name}" commands pointer escapes the plugin root or is not a regular file`, ExitCode.USAGE, { received: commands, field: 'commands', next: 'Fix plugin.json.commands.' });
-}
 function validateHttpInstall(name, endpoint, authEnv) {
-    if (typeof name !== 'string' || !PLUGIN_NAME_RE.test(name)) {
+    if (typeof name !== 'string' || !PLUGIN_NAME_RE.test(name))
         throw usage('invalid --name: expected a lowercase kebab-case plugin handle');
-    }
     const endpointValidation = validateEndpoint(endpoint);
-    if (!endpointValidation.isValid) {
+    if (!endpointValidation.isValid)
         throw usage(`invalid --endpoint: ${endpointValidation.errors.join('; ')}`);
-    }
     const normalizedEndpoint = normalizeEndpoint(endpoint);
-    const transportValidation = validateHttpPluginTransport({
-        kind: 'http',
-        endpoint: normalizedEndpoint,
-        ...(authEnv !== undefined ? { authEnv } : {}),
-    });
-    if (transportValidation.transport === undefined) {
+    const transportValidation = validateHttpPluginTransport({ kind: 'http', endpoint: normalizedEndpoint, ...(authEnv !== undefined ? { authEnv } : {}) });
+    if (transportValidation.transport === undefined)
         throw usage(`invalid HTTP plugin transport: ${transportValidation.errors.join('; ')}`);
-    }
     return transportValidation.transport;
 }
-async function installHttpPlugin(name, endpoint, authEnv, scope) {
-    const transport = validateHttpInstall(name, endpoint, authEnv);
-    const scopeRootPath = scope === 'project' ? ensureProjectScopeRoot() : userScopeRoot();
-    const root = join(scopeRootPath, 'plugins', name);
-    if (pathExists(root) && readPluginManifest(root)?.transport?.kind !== 'http') {
-        throw general(`plugin "${name}" already exists at ${root} and is not an HTTP-transport plugin`);
+function invocationTransport(bundle) {
+    return { kind: 'http', endpoint: new URL(bundle.endpoint).origin, ...(bundle.authEnv !== undefined ? { authEnv: bundle.authEnv } : {}) };
+}
+function stagedPath(stagingRoot, relative) {
+    const path = resolve(stagingRoot, relative);
+    if (path === stagingRoot || !path.startsWith(stagingRoot + sep)) {
+        throw general(`bundle member path escapes the staging directory: ${relative}`);
     }
-    if (pathExists(root) && resolveHttpPluginManifestStore({ root, commands: 'commands.json' }) === null) {
-        unsafeHttpManifestPath(name, 'commands.json');
+    return path;
+}
+function writeStagedBundle(stagingRoot, manifest, bundle) {
+    atomicWriteJson(stagedPath(stagingRoot, '.crouter-plugin/plugin.json'), manifest);
+    for (const directory of bundle.directories)
+        ensureDir(stagedPath(stagingRoot, directory.path));
+    writeFileSync(stagedPath(stagingRoot, 'commands.json'), bundle.commandsBytes);
+    for (const document of bundle.memory) {
+        const target = stagedPath(stagingRoot, document.path);
+        ensureDir(resolve(target, '..'));
+        writeFileSync(target, document.bytes);
     }
-    const fetched = await fetchHttpPluginManifest({
-        name,
-        endpoint: transport.endpoint,
-        ...(transport.authEnv !== undefined ? { authEnv: transport.authEnv } : {}),
-    });
+}
+function validateStagedBundle(name, scope, root, manifest) {
+    const staged = { name, scope, root, manifest, enabled: true };
+    const validation = validatePluginCommands(staged, new Set(SUBTREE_NAMES));
+    if (validation.issues.length > 0) {
+        throw general(`bundle staged package for "${name}" is invalid`, { issues: validation.issues });
+    }
+}
+function isSourceInstalled(plugin) {
+    return plugin.sourceMarketplace !== undefined || isGitRepo(plugin.root) || isSymlink(plugin.root);
+}
+function rejectLegacyHttpPlugin(name) {
+    throw general(`HTTP plugin "${name}" uses the removed commands-only endpoint format`, { next: `Run \`crtr pkg plugin remove ${name}\`, then reinstall it with \`crtr pkg plugin install --name ${name} --endpoint <archive-url>\`.` });
+}
+function existingBundleRoot(name, scope, root) {
+    if (!pathExists(root))
+        return undefined;
+    const existing = findPluginByName(name, scope);
+    if (existing?.manifest.bundle !== undefined)
+        return existing;
+    if (existing?.manifest.transport?.kind === 'http' && existing !== undefined && !isSourceInstalled(existing))
+        rejectLegacyHttpPlugin(name);
+    throw general(`plugin "${name}" already exists at ${root}; run \`crtr pkg plugin remove ${name}\` before installing the archive plugin.`);
+}
+async function replaceBundlePlugin(name, bundleSource, scope, options) {
+    const fetchTransport = validateHttpInstall(name, bundleSource.endpoint, bundleSource.authEnv);
+    const bundle = { endpoint: fetchTransport.endpoint, ...(fetchTransport.authEnv !== undefined ? { authEnv: fetchTransport.authEnv } : {}) };
+    const transport = invocationTransport(bundle);
+    const scopeRootPath = scope === 'project' ? ensureProjectScopeRoot() : userScopeRoot();
+    const root = join(scopeRootPath, 'plugins', name);
+    existingBundleRoot(name, scope, root);
+    const fetched = await fetchHttpPluginBundle({ name, endpoint: bundle.endpoint, ...(bundle.authEnv !== undefined ? { authEnv: bundle.authEnv } : {}) });
     if (fetched.status !== 200) {
-        const message = `HTTP plugin install failed for "${name}": ${fetched.message}`;
+        const message = `HTTP plugin bundle fetch failed for "${name}": ${fetched.message}`;
         if (fetched.status === 'auth_env_missing')
             throw usage(message);
         if (fetched.status === 'cli_unreachable')
             throw network(message);
         throw general(message);
     }
-    ensureScopeInitialized(scope, scopeRootPath);
-    atomicWriteJson(pluginManifestPath(root), {
+    const validated = await validatePluginBundle(fetched.raw, { reservedCoreNames: new Set(SUBTREE_NAMES) });
+    if (validated.bundle === undefined)
+        throw general(`HTTP plugin bundle for "${name}" is invalid`, { issues: validated.issues });
+    const version = createHash('sha256').update(fetched.raw).digest('hex').slice(0, 12);
+    const manifest = {
         name,
+        version,
         commands: 'commands.json',
         transport,
-    });
-    const store = resolveHttpPluginManifestStore({ root, commands: 'commands.json' });
-    if (store === null)
-        unsafeHttpManifestPath(name, 'commands.json');
-    writeHttpPluginManifest(store, fetched.raw);
+        bundle,
+    };
+    const tmpRoot = join(scopeRootPath, 'tmp');
+    const staging = join(tmpRoot, `${name}.${process.pid}`);
+    const previous = `${staging}.prev`;
+    if (pathExists(previous))
+        throw general(`cannot replace plugin "${name}": prior interrupted replacement remains at ${previous}`);
+    ensureDir(tmpRoot);
+    ensureDir(join(scopeRootPath, 'plugins'));
+    removePath(staging);
+    try {
+        ensureDir(staging);
+        writeStagedBundle(staging, manifest, validated.bundle);
+        validateStagedBundle(name, scope, staging, manifest);
+        let movedPrevious = false;
+        if (pathExists(root)) {
+            renameSync(root, previous);
+            movedPrevious = true;
+        }
+        try {
+            renameSync(staging, root);
+        }
+        catch (error) {
+            if (movedPrevious)
+                renameSync(previous, root);
+            throw error;
+        }
+        if (movedPrevious)
+            removePath(previous);
+    }
+    finally {
+        removePath(staging);
+    }
+    ensureScopeInitialized(scope, scopeRootPath);
     updateConfig(scope, (cfg) => {
-        cfg.plugins[name] = { enabled: true };
+        cfg.plugins[name] = { enabled: options.enable ? true : (cfg.plugins[name]?.enabled ?? true), version };
+    });
+    updateState(scope, (state) => {
+        if (state.plugins[name] === undefined)
+            state.plugins[name] = {};
+        state.plugins[name].last_updated = nowIso();
     });
     const commands = commandReport(name, scope);
-    return { name, scope, path: root, transport: 'http', ...(commands !== undefined ? { commands } : {}) };
+    if (commands === undefined)
+        throw general(`bundle plugin "${name}" has no staged command report`);
+    return { name, scope, path: root, transport: 'http', version, docs: validated.bundle.memory.length, commands };
+}
+async function installHttpPlugin(name, endpoint, authEnv, scope) {
+    const source = validateHttpInstall(name, endpoint, authEnv);
+    return replaceBundlePlugin(name, { endpoint: source.endpoint, ...(source.authEnv !== undefined ? { authEnv: source.authEnv } : {}) }, scope, { enable: true });
 }
 function classifyInstallRef(raw) {
     if (raw.startsWith('./') || raw.startsWith('../') || raw.startsWith('/')) {
@@ -269,22 +340,13 @@ export function installFromMarketplace(ref, scope) {
     return { name: ref.plugin, scope, path: destPluginDir };
 }
 async function updateOnePlugin(plugin, marketplaceCache, opts) {
-    if (plugin.manifest.transport?.kind === 'http') {
-        const commandsPath = plugin.manifest.commands;
-        if (typeof commandsPath !== 'string' || commandsPath.length === 0) {
-            throw usage(`HTTP plugin "${plugin.name}" has no commands path in plugin.json; fix the manifest before updating.`);
-        }
-        const store = resolveHttpPluginManifestStore({ root: plugin.root, commands: commandsPath });
-        if (store === null)
-            unsafeHttpManifestPath(plugin.name, commandsPath);
-        await refreshHttpPlugin({
-            name: plugin.name,
-            endpoint: plugin.manifest.transport.endpoint,
-            ...(plugin.manifest.transport.authEnv !== undefined ? { authEnv: plugin.manifest.transport.authEnv } : {}),
-        }, store);
-        const commands = commandReport(plugin.name, plugin.scope);
-        return { name: plugin.name, transport: 'http', updated: true, ...(commands !== undefined ? { commands } : {}) };
+    const sourceInstalled = isSourceInstalled(plugin);
+    if (!sourceInstalled && plugin.manifest.bundle !== undefined) {
+        const replaced = await replaceBundlePlugin(plugin.name, plugin.manifest.bundle, plugin.scope, { enable: plugin.enabled });
+        return { name: plugin.name, transport: 'http', updated: true, version: replaced.version, docs: replaced.docs, commands: replaced.commands };
     }
+    if (plugin.manifest.transport?.kind === 'http' && !sourceInstalled)
+        rejectLegacyHttpPlugin(plugin.name);
     let contentUpdate = { updated: false, sha: currentSha(plugin.root) ?? '' };
     let marketplaceVersion;
     if (plugin.sourceMarketplace !== undefined) {
@@ -309,7 +371,7 @@ async function updateOnePlugin(plugin, marketplaceCache, opts) {
     const commands = commandReport(plugin.name, plugin.scope);
     return {
         name: plugin.name,
-        ...(plugin.manifest.transport?.kind === 'exec' ? { transport: 'exec' } : {}),
+        ...(plugin.manifest.transport !== undefined ? { transport: plugin.manifest.transport.kind } : {}),
         updated: contentUpdate.updated,
         sha: contentUpdate.sha,
         ...(commands !== undefined ? { commands } : {}),
@@ -318,13 +380,13 @@ async function updateOnePlugin(plugin, marketplaceCache, opts) {
 export const pluginInstall = defineLeaf({
     name: 'install',
     description: 'install from a ref or HTTP endpoint',
-    whenToUse: 'installing one plugin from a marketplace ref, git URL, local path, or an HTTP command-manifest endpoint',
+    whenToUse: 'installing one plugin from a marketplace ref, git URL, local path, or an HTTP directory-archive endpoint',
     help: {
         name: 'pkg plugin install',
         summary: 'install a plugin from a ref or HTTP endpoint',
         params: [
             { kind: 'positional', name: 'install-ref', type: 'string', required: false, constraint: 'Plugin install ref. Provide exactly one of INSTALL-REF or --endpoint. Accepted ref forms: marketplace/plugin; git URL starting https://, ssh://, git@, file://, or ending .git; local path starting ./, ../, or /.' },
-            { kind: 'flag', name: 'endpoint', type: 'string', required: false, constraint: 'HTTP plugin endpoint. Provide exactly one of --endpoint or INSTALL-REF. Must be an absolute https: URL; http: is permitted only for localhost, 127.0.0.1, [::1], ::1, or host.docker.internal. Credentials and fragments are rejected.' },
+            { kind: 'flag', name: 'endpoint', type: 'string', required: false, constraint: 'HTTP plugin directory-archive endpoint. Provide exactly one of --endpoint or INSTALL-REF. Must be an absolute https: URL; http: is permitted only for localhost, 127.0.0.1, [::1], ::1, or host.docker.internal. Credentials and fragments are rejected.' },
             { kind: 'flag', name: 'name', type: 'string', required: false, constraint: 'Required with --endpoint and rejected without it. Lowercase kebab-case plugin handle.' },
             { kind: 'flag', name: 'auth-env', type: 'string', required: false, constraint: 'Optional environment variable holding the HTTP bearer token. Accepted only with --endpoint; its value is never stored.' },
             { kind: 'flag', name: 'scope', type: 'enum', choices: ['user', 'project'], required: false, constraint: 'Default: project if available, else user.' },
@@ -335,12 +397,14 @@ export const pluginInstall = defineLeaf({
             { name: 'scope', type: 'string', required: true, constraint: 'Scope the plugin was installed into.' },
             { name: 'path', type: 'string', required: true, constraint: 'Absolute path to the installed plugin directory.' },
             { name: 'transport', type: 'string', required: false, constraint: 'exec or http when the plugin declares commands. Always http for an --endpoint install.' },
+            { name: 'version', type: 'string', required: false, constraint: 'First 12 hex characters of the fetched archive SHA-256 for an --endpoint install.' },
+            { name: 'docs', type: 'integer', required: false, constraint: 'Memory document count written from an --endpoint archive.' },
             { name: 'commands', type: 'object', required: false, constraint: 'Present only when the plugin declares a command manifest. {mounts: string[] (accepted top-level command names now live for the next invocation), issues: object[] (typed validation issues that rejected a contribution — {code, path?, message, received, expected, next})}. Validated statically; commands are never executed.' },
         ],
         outputKind: 'object',
         effects: [
             'A ref install clones, links, or copies the plugin into the scope plugins directory and registers it with enabled=true. Marketplace installs refresh the source marketplace before resolving the plugin entry.',
-            'An --endpoint install validates inputs, fetches the command manifest before writing, then writes plugin.json and commands.json and enables the plugin. Reinstalling the same HTTP plugin name replaces its stored manifest and metadata; a fetch failure writes nothing.',
+            'An --endpoint install fetches and validates one authenticated uncompressed tar archive before writing. It replaces the complete plugin directory with synthesized provenance and invocation metadata, commands.json, and memory docs; a fetch or validation failure preserves the prior package.',
             'If the plugin declares a command manifest, its commands go live on the next crtr invocation. Exec commands run trusted local code only when explicitly invoked; HTTP commands call their declared endpoint only when explicitly invoked.',
         ],
     },
@@ -478,7 +542,7 @@ export const pluginDisable = defineLeaf({
 export const pluginUpdate = defineLeaf({
     name: 'update',
     description: 'update installed plugin content',
-    whenToUse: 'refreshing one named plugin or all installed plugins: HTTP plugins re-fetch their command manifest, while local plugins retain their git update behavior',
+    whenToUse: 'refreshing one named plugin or all installed plugins: archive plugins replace commands and memory together, while source-installed plugins retain their source update behavior',
     help: {
         name: 'pkg plugin update',
         summary: 'refresh one or all installed plugins',
@@ -486,10 +550,10 @@ export const pluginUpdate = defineLeaf({
             { kind: 'flag', name: 'name', type: 'string', required: false, constraint: 'Plugin name to update. Omit to update all installed plugins.' },
         ],
         output: [
-            { name: 'updated', type: 'object[]', required: true, constraint: 'One entry per plugin processed: {name, transport?, updated, sha?, commands?}. HTTP plugins report transport=http and replace commands.json after an authenticated refetch; sha is present for git updates. commands is present only for plugins declaring a command manifest: {mounts: string[] (accepted top-level command names), issues: object[] ({code, path?, message, received, expected, next})} — validated statically, never executing commands.' },
+            { name: 'updated', type: 'object[]', required: true, constraint: 'One entry per plugin processed: {name, transport?, updated, sha?, version?, docs?, commands?, error?}. Archive plugins report transport=http and replace their complete directory after an authenticated refetch; version is the archive content identifier and docs is the written memory-document count. sha is present for git updates. A bulk update reports and skips a failed archive plugin. commands is present for validated command plugins: {mounts: string[], issues: object[]}.' },
         ],
         outputKind: 'object',
-        effects: ['HTTP plugins unconditionally re-fetch and replace commands.json; a fetch failure exits nonzero and preserves prior bytes. Other plugins retain their git pull, version, and last_updated behavior.'],
+        effects: ['Archive plugins unconditionally re-fetch, validate, and replace their complete package; a named failure exits nonzero and preserves the prior package. Bulk update reports a failed archive plugin and continues. Source-installed plugins retain their source update, version, and last_updated behavior.'],
     },
     run: async (input) => {
         const name = input['name'];
@@ -503,8 +567,19 @@ export const pluginUpdate = defineLeaf({
         }
         const targets = listAllPlugins().filter((p) => p.scope !== 'builtin');
         const results = [];
-        for (const plugin of targets)
-            results.push(await updateOnePlugin(plugin, marketplaceCache, { strict: false }));
+        for (const plugin of targets) {
+            try {
+                results.push(await updateOnePlugin(plugin, marketplaceCache, { strict: false }));
+            }
+            catch (error) {
+                results.push({
+                    name: plugin.name,
+                    ...(plugin.manifest.transport !== undefined ? { transport: plugin.manifest.transport.kind } : {}),
+                    updated: false,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
         return { updated: results };
     },
 });

package/dist/commands/sys/__tests__/setup-core.test.js

@@ -20,8 +20,10 @@ test('setup keybinding draft edits, disables, resets, and discards transactional
     const draft = new SetupKeybindingsDraft({ 'crtr.attach.graph.toggle': ['alt+x'] });
     assert.equal(draft.expression('crtr.attach.graph.toggle'), 'alt+x');
     assert.equal(draft.dirty, false);
-    assert.equal(draft.edit('crtr.attach.graph.toggle', 'M-Y, ctrl+g').ok, true);
-    assert.deepEqual(draft.overrides()['crtr.attach.graph.toggle'], ['alt+shift+y', 'ctrl+g']);
+    // M-U (not M-Y): alt+shift+y is now the crtr.attach.copy.message default, so
+    // the uppercase-normalization probe must use a gesture no catalog entry owns.
+    assert.equal(draft.edit('crtr.attach.graph.toggle', 'M-U, ctrl+g').ok, true);
+    assert.deepEqual(draft.overrides()['crtr.attach.graph.toggle'], ['alt+shift+u', 'ctrl+g']);
     assert.equal(draft.dirty, true);
     assert.equal(draft.unbind('crtr.attach.graph.toggle').ok, true);
     assert.deepEqual(draft.overrides()['crtr.attach.graph.toggle'], []);

package/dist/commands/sys/setup-core.js

@@ -10,7 +10,7 @@ import { readJsonIfExists } from '../../core/fs-utils.js';
 import { resolveBundledPiCliPath } from '../../core/runtime/pi-cli.js';
 import { installTmuxBindings } from '../../core/runtime/tmux-chrome.js';
 import { detectNerdFont, nerdFontInstallCommand, NERD_FONT_SELECT_HINT } from '../../core/runtime/nerd-font.js';
-import { globalHumanloopHealth, globalHumanloopInstallCommand } from '../../core/runtime/package-health.js';
+import { ensureRenderer, isRendererReady } from '../../core/termrender/termrender.js';
 import { registerCrouterRoot } from '../human/shared.js';
 import { installFromMarketplace } from '../pkg/plugin-manage.js';
 import { findPluginByName } from '../../core/resolver.js';
@@ -468,17 +468,15 @@ function installPiPackage(source, piCliPath = resolveBundledPiCliPath()) {
         throw new Error(`pi install failed: ${source}`);
     }
 }
-/** Keep the PATH-global executable used by the tmux inbox binding at least as
- * new as crouter's bundled humanloop library. This is deliberately separate
- * from pi's companion package install: `hl` is a global npm binary, not a pi
- * package entry in settings.json. */
-function ensureGlobalHumanloop() {
-    if (globalHumanloopHealth().current)
-        return false;
-    const command = globalHumanloopInstallCommand();
-    process.stdout.write(`Updating global hl CLI: ${command}\n`);
-    runShellCommand(command);
-    return true;
+/** Provision the pinned termrender venv — crouter's one remaining out-of-tree
+ * dependency. Best-effort: a renderer that will not provision (no `uv`, no
+ * network) reports as skipped and never fails setup. */
+function ensureManagedRenderer() {
+    if (isRendererReady())
+        return 'current';
+    process.stdout.write('Provisioning the pinned termrender renderer…\n');
+    ensureRenderer();
+    return isRendererReady() ? 'provisioned' : 'unavailable';
 }
 export async function writeExaKey(exaKeyPath, exaKey) {
     await mkdir(dirname(exaKeyPath), { recursive: true });
@@ -572,10 +570,17 @@ export async function executeSetupSubmission(submission) {
         runShellCommand(plan.command);
         installedSystemDeps.push(plan.tool);
     }
-    if (ensureGlobalHumanloop())
-        installedPackages.push('global hl CLI');
-    else
-        skippedPackages.push('global hl CLI (current)');
+    switch (ensureManagedRenderer()) {
+        case 'provisioned':
+            installedPackages.push('termrender renderer');
+            break;
+        case 'current':
+            skippedPackages.push('termrender renderer (current)');
+            break;
+        case 'unavailable':
+            skippedPackages.push('termrender renderer (unavailable — install uv)');
+            break;
+    }
     const exaKeyWritten = submission.exaKey.trim() !== '';
     if (exaKeyWritten) {
         await writeExaKey(submission.exaKeyPath, submission.exaKey);

package/dist/core/clipboard-text.d.ts

@@ -1,3 +1,11 @@
 /** Write `text` to the system clipboard. Returns true on success, false when no
  *  clipboard tool is available or every attempt failed. Never throws. */
 export declare function writeClipboardText(text: string): boolean;
+/** Write `text` to the system clipboard AND, inside tmux, to the tmux paste
+ *  buffer via `tmux load-buffer -w -` (which makes tmux emit OSC 52 outward on
+ *  the app's behalf). Never emits OSC 52 from this process. Never throws.
+ *  Returns which operations succeeded. */
+export declare function writeClipboardTextEverywhere(text: string): {
+    system: boolean;
+    tmux: boolean;
+};

package/dist/core/clipboard-text.js

@@ -37,3 +37,21 @@ export function writeClipboardText(text) {
     }
     return false;
 }
+/** Write `text` to the system clipboard AND, inside tmux, to the tmux paste
+ *  buffer via `tmux load-buffer -w -` (which makes tmux emit OSC 52 outward on
+ *  the app's behalf). Never emits OSC 52 from this process. Never throws.
+ *  Returns which operations succeeded. */
+export function writeClipboardTextEverywhere(text) {
+    const system = writeClipboardText(text);
+    let tmux = false;
+    if (process.env.TMUX !== undefined) {
+        const result = spawnSync('tmux', ['load-buffer', '-w', '-'], {
+            input: text,
+            timeout: SPAWN_TIMEOUT_MS,
+            encoding: 'utf-8',
+        });
+        // Success if no error and exit status 0.
+        tmux = !result.error && result.status === 0;
+    }
+    return { system, tmux };
+}

package/dist/core/command-manifests/registry.d.ts

@@ -25,9 +25,7 @@ export interface ContributorIssue extends CommandManifestIssue {
     contributor: CommandContributorRef;
 }
 /** Invocation-local registry snapshot after collision resolution: the accepted
- *  contributions and every discovered issue. The amended spec has no freshness
- *  machinery, so there is no owner-routing map — an unknown-token miss hydrates
- *  ALL absent-store registrations once (§5.1), never a single known owner. */
+ *  contributions and every discovered issue. */
 export interface CommandRegistrySnapshot {
     /** Accepted top-level contributions, deterministically ordered by
      *  contributor name. */

package/dist/core/command-plugins/bundle.d.ts

@@ -0,0 +1,29 @@
+import { type ValidatedCommandManifest } from '../command-manifests/manifest.js';
+export interface BundleIssue {
+    code: string;
+    path?: string;
+    message: string;
+    received: string;
+    expected: string;
+    next: string;
+}
+export interface ValidatedBundle {
+    bundleVersion: 1;
+    commands: ValidatedCommandManifest;
+    commandsBytes: Uint8Array;
+    directories: ReadonlyArray<{
+        path: string;
+    }>;
+    memory: ReadonlyArray<{
+        path: string;
+        bytes: Uint8Array;
+    }>;
+}
+export interface PluginBundleValidation {
+    bundle?: ValidatedBundle;
+    issues: BundleIssue[];
+}
+/** Validate a Core-served plugin directory archive entirely in memory. */
+export declare function validatePluginBundle(archive: Uint8Array, options: {
+    reservedCoreNames: ReadonlySet<string>;
+}): Promise<PluginBundleValidation>;