@north-light/crouter 0.3.170 → 0.3.172

package/dist/core/canvas/db.js

@@ -6,8 +6,8 @@
 // owns, so the db is authoritative for them.
 import { DatabaseSync } from 'node:sqlite';
 import { existsSync, readFileSync, readdirSync, appendFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { canvasDbPath, ensureHome, nodesRoot, nodeMetaPath } from './paths.js';
+import { basename, join, resolve } from 'node:path';
+import { canvasDbPath, ensureHome, isSafeNodeId, nodesRoot, nodeMetaPath } from './paths.js';
 import { customExtensionPaths } from './extensions.js';
 import { updateJsonFileDurably } from './meta-file.js';
 // --- Schema as a forward-only migration list ------------------------------
@@ -448,46 +448,20 @@ function addMessageWaitGenerationColumn(db) {
     const columns = nodeColumns(db);
     addNodeColumnIfMissing(db, columns, 'waiting_for_generation', `ALTER TABLE nodes ADD COLUMN waiting_for_generation INTEGER NOT NULL DEFAULT 0;`);
 }
-/** v18 — the `consult_outbox` table: the receipted delivery record for a Lane B
- *  follow-up consultation fork's answer (design-followup-consult-v2.md §B.4).
- *  One row per consult fork (`node_id` PK). `status` walks armed → pending →
- *  acked (happy path) or armed/pending → errored/canceled (failure/cancel
- *  paths). `final_report` (the basename under the fork's `reports/`) is set
- *  only when the row is promoted armed→pending inside the SAME SQLite
- *  transaction that commits the fork's canonical final (`feed.ts
- *  commitCanonicalFinal`) — that atomicity is the whole point of the outbox:
- *  a crash between commit and dispatch still leaves a durable `pending` row
- *  for follow-up reconciliation to redeliver. `dir`/`root`/`request_id` bind
- *  the row back to the humanloop ticket + the exact follow-up request it
- *  answers, so a stale/superseded fork's late delivery is a no-op at the
- *  humanloop layer (compare-and-publish under `.followup-lock`), never here.
- *
- *  NO foreign key on `node_id` (matches the authoritative design's schema
- *  exactly — it declares no FK at all): unlike the retired `triggers`/`wakeups`
- *  tables did, an
- *  unsettled (`armed`/`pending`) receipt is the ONLY durable record that a
- *  follow-up answer is still owed, and ordinary node pruning (`canvas.ts`
- *  `pruneNodes`) deletes terminal node rows + their `reports/` dirs on a
- *  routine schedule that has nothing to do with whether humanloop has
- *  actually accepted the delivery. A `nodes` cascade would let a prune race
- *  silently erase that receipt (and, once `final_report` is set, the report
- *  file itself) before follow-up reconciliation/delivery ever
- *  runs — the crash-safety net the whole table exists to provide. Only
- *  `acked`/`errored`/`canceled` rows are truly done; those are reaped by the
- *  outbox's own housekeeping, never by a `nodes` FK. Two composite indexes
- *  back the request-bound and ticket-bound DAO reads a `_consult`/`_deliver`
- *  caller needs (`getActiveFollowUpWorkByRequest`,
- *  `listActiveFollowUpWorkByDir` in human-work-outbox.ts) without scanning
- *  every row in the table. Additive, forward-only. */
+/** v18 — create the historical `consult_outbox` table. The old schema stays
+ *  replayable for existing databases until its later migration removes it.
+ *  No current user-facing flow creates rows. Its remaining diagnostics and
+ *  retention readers keep armed/pending legacy rows from losing their node
+ *  before startup or crash reconciliation terminalizes those rows. */
 function addHumanWorkOutboxTable(db) {
     db.exec(`
 CREATE TABLE IF NOT EXISTS consult_outbox (
-  node_id      TEXT PRIMARY KEY,   -- the consult fork's id
-  dir          TEXT NOT NULL,      -- ticket dir
-  root         TEXT NOT NULL,      -- registered root (for submitFollowUpResult auth)
-  request_id   TEXT NOT NULL,      -- binds this fork to one follow-up request
+  node_id      TEXT PRIMARY KEY,   -- legacy work node id
+  dir          TEXT NOT NULL,      -- legacy ticket directory
+  root         TEXT NOT NULL,      -- legacy registered root
+  request_id   TEXT NOT NULL,      -- legacy request id
   status       TEXT NOT NULL,      -- armed | pending | acked | errored | canceled
-  final_report TEXT,               -- basename of reports/<...>-final.md, set on promote
+  final_report TEXT,               -- legacy final report basename
   updated_at   TEXT NOT NULL
 );
 CREATE INDEX IF NOT EXISTS idx_consult_outbox_status ON consult_outbox(status);
@@ -968,6 +942,196 @@ CREATE TABLE IF NOT EXISTS warm_pool (
 CREATE INDEX IF NOT EXISTS idx_warm_pool_recipe ON warm_pool(recipe_key, created);
 `);
 }
+/** v26 — narrow `consult_outbox` for the humanloop absorption into
+ *  `src/core/human/` (absorb-humanloop
+ *  design, "The human-work receipt table"; Landing 2 Part E task E2). The
+ *  five-column trust binding (`handler_command`, `handler_args_json`,
+ *  `claim_token`, `generation_id`, `interaction_snapshot`) existed only to let
+ *  crtrd re-verify that a Visual event arrived through crouter's own
+ *  registered handler argv — that registry is deleted in this landing, so
+ *  there is nothing left to bind. `dir`/`root` collapse into `ticket_node_id`,
+ *  the bridge node id a ticket's directory is derived from at every call site
+ *  (`ticketDir(nodeId)` in `src/core/human/root.ts`) — `basename(dir)` IS that
+ *  node id today, already relied on as such at
+ *  `src/daemon/api/handlers/human.ts:290` (`const jobId = basename(dir)`) and
+ *  `src/core/canvas/attention.ts:21`.
+ *
+ *  THIS IS A TABLE REBUILD, NOT `ALTER TABLE … DROP COLUMN`: six of the nine
+ *  existing indexes are on `dir` (`idx_consult_outbox_dir`,
+ *  `idx_consult_outbox_dir_request_status`, `idx_consult_outbox_dir_status`
+ *  from v18; `idx_consult_outbox_human_work_dir_status`,
+ *  `idx_consult_outbox_human_work_request_status`, and the partial-unique
+ *  `idx_consult_outbox_visual_request` from v19), and SQLite refuses
+ *  `DROP COLUMN` on any indexed column. `ticket_node_id` cannot be a SQL
+ *  DEFAULT either — SQLite has no `basename()` — so it is computed per row in
+ *  JS: read every existing row through a prepared SELECT, insert each into a
+ *  freshly created `consult_outbox_new` with `ticket_node_id = basename(dir)`,
+ *  drop the old table (dropping its indexes with it), rename the new table
+ *  into place, and recreate exactly five indexes on the narrowed shape. Every
+ *  row is carried, including terminal ones, EXCEPT a row whose legacy `dir` is
+ *  not a canonical direct child of its recorded `root`, or whose basename is
+ *  not a safe node id — either would create an unaddressable or aliased ticket
+ *  id once `root` is discarded. A warning names how many are dropped.
+ *
+ *  THERE IS NO ROLLBACK. A sealed older runtime generation still running
+ *  against this canvas.db fails on the Visual lane (`INSERT INTO
+ *  consult_outbox (… dir, root, handler_command …)`) once this has run —
+ *  acceptable because this migration lands WITH a generation roll
+ *  (`npm run build && npm run install-runtime && crtr sys daemon restart`),
+ *  never alongside one. Not self-transactional: like every ordinary migration
+ *  it runs inside `migrate()`'s per-step `BEGIN IMMEDIATE`, so an interrupted
+ *  run leaves `consult_outbox` exactly as it was (SQLite DDL is transactional)
+ *  and a re-open resumes cleanly at the same step. */
+function narrowHumanWorkOutbox(db) {
+    const rows = db
+        .prepare('SELECT node_id, dir, root, request_id, work_kind, status, final_report, updated_at FROM consult_outbox')
+        .all();
+    db.exec(`
+CREATE TABLE consult_outbox_new (
+  node_id        TEXT PRIMARY KEY,
+  ticket_node_id TEXT NOT NULL,
+  request_id     TEXT NOT NULL,
+  work_kind      TEXT NOT NULL DEFAULT 'follow_up',
+  status         TEXT NOT NULL,
+  final_report   TEXT,
+  updated_at     TEXT NOT NULL
+);
+`);
+    const insert = db.prepare(`
+INSERT INTO consult_outbox_new (node_id, ticket_node_id, request_id, work_kind, status, final_report, updated_at)
+VALUES (?, ?, ?, ?, ?, ?, ?)`);
+    let dropped = 0;
+    for (const row of rows) {
+        const ticketNodeId = basename(row.dir);
+        const directChild = row.root === resolve(row.root) && row.dir === join(row.root, ticketNodeId);
+        if (!directChild || !isSafeNodeId(ticketNodeId)) {
+            dropped += 1;
+            continue;
+        }
+        insert.run(row.node_id, ticketNodeId, row.request_id, row.work_kind, row.status, row.final_report, row.updated_at);
+    }
+    if (dropped > 0) {
+        console.warn(`[canvas migration v26] dropped ${dropped} consult_outbox row(s) whose legacy ticket path cannot safely map to a ticket node id`);
+    }
+    db.exec(`
+DROP TABLE consult_outbox;
+ALTER TABLE consult_outbox_new RENAME TO consult_outbox;
+
+CREATE INDEX IF NOT EXISTS idx_consult_outbox_status ON consult_outbox(status);
+CREATE INDEX IF NOT EXISTS idx_consult_outbox_human_work_status ON consult_outbox(work_kind, status);
+CREATE INDEX IF NOT EXISTS idx_consult_outbox_ticket_status ON consult_outbox(ticket_node_id, work_kind, status);
+CREATE INDEX IF NOT EXISTS idx_consult_outbox_ticket_request_status ON consult_outbox(ticket_node_id, request_id, work_kind, status);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_consult_outbox_visual_request ON consult_outbox(ticket_node_id, request_id, work_kind) WHERE work_kind = 'visual';
+`);
+}
+/** v27 — the canonical daemon-owned review record. */
+function addReviewsTable(db) {
+    db.exec(`
+CREATE TABLE IF NOT EXISTS reviews (
+  review_id            TEXT PRIMARY KEY,
+  idempotency_key      TEXT NOT NULL UNIQUE,
+  origin_kind          TEXT NOT NULL CHECK (origin_kind IN ('ticket', 'inline')),
+  origin_node_id       TEXT NOT NULL,
+  bridge_node_id       TEXT,
+  companion_node_id    TEXT NOT NULL UNIQUE,
+  review_dir           TEXT NOT NULL,
+  file                 TEXT NOT NULL,
+  origin_session_file  TEXT NOT NULL,
+  origin_session_id    TEXT NOT NULL,
+  origin_leaf_id       TEXT NOT NULL,
+  model_spec           TEXT NOT NULL,
+  branch_file          TEXT NOT NULL,
+  baseline_sha256      TEXT NOT NULL,
+  baseline_bytes       INTEGER NOT NULL,
+  anchor_base_sha256   TEXT NOT NULL,
+  anchor_base_bytes    BLOB NOT NULL,
+  state                TEXT NOT NULL CHECK (state IN ('binding', 'open', 'approved', 'canceled')),
+  created              TEXT NOT NULL,
+  captured_at          TEXT NOT NULL,
+  opened_at            TEXT,
+  output_path          TEXT,
+  subtitle             TEXT,
+  approved_at          TEXT,
+  approved_sha256      TEXT,
+  changed              INTEGER,
+  comments_total       INTEGER,
+  comments_unresolved  INTEGER,
+  result_json          TEXT,
+  canceled_at          TEXT,
+  cancel_reason        TEXT,
+  cancel_actor         TEXT,
+  delivery_entry_id    TEXT,
+  delivered_at         TEXT,
+  delivery_error       TEXT,
+  projected_at         TEXT,
+  projection_error     TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_reviews_state ON reviews(state);
+CREATE INDEX IF NOT EXISTS idx_reviews_origin ON reviews(origin_node_id);
+CREATE INDEX IF NOT EXISTS idx_reviews_file ON reviews(file);
+CREATE INDEX IF NOT EXISTS idx_reviews_bridge ON reviews(bridge_node_id);
+`);
+}
+/** v28 — current review-comment projection and append-only comment audit. */
+function addReviewCommentTables(db) {
+    db.exec(`
+CREATE TABLE IF NOT EXISTS review_comments (
+  comment_id          TEXT PRIMARY KEY,
+  review_id           TEXT NOT NULL,
+  status              TEXT NOT NULL CHECK (status IN ('open', 'resolved', 'deleted')),
+  revision            INTEGER NOT NULL,
+  text                TEXT NOT NULL,
+  anchor_line         INTEGER NOT NULL,
+  anchor_end_line     INTEGER NOT NULL,
+  anchor_col_start    INTEGER,
+  anchor_col_end      INTEGER,
+  anchor_quote        TEXT,
+  anchor_line_text    TEXT NOT NULL,
+  anchor_doc_hash     TEXT NOT NULL,
+  author_kind         TEXT NOT NULL CHECK (author_kind IN ('human', 'node')),
+  author_node_id      TEXT,
+  updated_by_kind     TEXT NOT NULL CHECK (updated_by_kind IN ('human', 'node')),
+  updated_by_node_id  TEXT,
+  created_at          TEXT NOT NULL,
+  updated_at          TEXT NOT NULL,
+  resolved_at         TEXT,
+  deleted_at          TEXT,
+  created_seq         INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS review_comment_events (
+  seq             INTEGER PRIMARY KEY AUTOINCREMENT,
+  review_id       TEXT NOT NULL,
+  comment_id      TEXT NOT NULL,
+  kind            TEXT NOT NULL CHECK (kind IN ('created', 'edited', 'resolved', 'reopened', 'deleted', 'reanchored', 'notified', 'notify_failed')),
+  state_change    INTEGER NOT NULL,
+  revision_after  INTEGER,
+  actor_kind      TEXT NOT NULL CHECK (actor_kind IN ('human', 'node', 'system')),
+  actor_node_id   TEXT,
+  at              TEXT NOT NULL,
+  operation_id    TEXT NOT NULL,
+  payload         TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_review_comments_review_line_seq
+  ON review_comments(review_id, anchor_line, created_seq);
+CREATE INDEX IF NOT EXISTS idx_review_comments_review_status
+  ON review_comments(review_id, status);
+CREATE INDEX IF NOT EXISTS idx_review_comment_events_review_seq
+  ON review_comment_events(review_id, seq);
+CREATE INDEX IF NOT EXISTS idx_review_comment_events_comment_seq
+  ON review_comment_events(comment_id, seq);
+`);
+}
+/** v29 — durable review-comment anchor disposition. v28 is already released, so this corrects both fresh and migrated databases without rewriting its historical schema. */
+function addReviewCommentAnchorState(db) {
+    db.exec(`
+ALTER TABLE review_comments
+  ADD COLUMN anchor_state TEXT NOT NULL DEFAULT 'live' CHECK (anchor_state IN ('live', 'detached'));
+`);
+}
+/** v30 — remove the retired human-work receipt table after every runtime reader is gone. */
+function dropConsultOutbox(db) {
+    db.exec('DROP TABLE IF EXISTS consult_outbox');
+}
 /** The ordered migration list. Index `i` is migration version `i + 1`; the db's
  *  `user_version` tracks how many have been applied. Append only. */
 export const MIGRATIONS = [
@@ -998,6 +1162,11 @@ export const MIGRATIONS = [
     /* v23 */ addCronRunPidIdentityColumn,
     /* v24 */ addCronOutOfBandColumn,
     /* v25 */ addWarmPoolTable,
+    /* v26 */ narrowHumanWorkOutbox,
+    /* v27 */ addReviewsTable,
+    /* v28 */ addReviewCommentTables,
+    /* v29 */ addReviewCommentAnchorState,
+    /* v30 */ dropConsultOutbox,
 ];
 /** Migration indexes that manage their OWN transaction and therefore must not
  *  be wrapped by `migrate()` — `node:sqlite` rejects a nested BEGIN. Index 3

package/dist/core/canvas/extensions.d.ts

@@ -1,4 +1,4 @@
-export declare const CANVAS_EXTENSION_NAMES: readonly ["canvas-inbox-watcher", "canvas-stophook", "canvas-recap", "canvas-goal-capture", "canvas-passive-context", "canvas-context-intro", "canvas-tool-guide", "canvas-doc-substrate", "canvas-structured-output", "canvas-bash-valve"];
+export declare const CANVAS_EXTENSION_NAMES: readonly ["canvas-inbox-watcher", "canvas-review-boundary", "canvas-stophook", "canvas-recap", "canvas-goal-capture", "canvas-passive-context", "canvas-context-intro", "canvas-tool-guide", "canvas-doc-substrate", "canvas-structured-output", "canvas-bash-valve"];
 /** Remove a complete persisted canvas prefix while retaining every genuine
  * caller/kind extra, including a custom extension whose basename happens to
  * resemble a canvas hook. */

package/dist/core/canvas/extensions.js

@@ -3,12 +3,19 @@
 // canvas-inbox-watcher must load before canvas-stophook: at agent_settled it
 // commits the cursor the stophook then reads to decide idle release.
 export const CANVAS_EXTENSION_NAMES = [
-    'canvas-inbox-watcher', 'canvas-stophook', 'canvas-recap',
+    'canvas-inbox-watcher', 'canvas-review-boundary', 'canvas-stophook', 'canvas-recap',
     'canvas-goal-capture', 'canvas-passive-context', 'canvas-context-intro',
     'canvas-tool-guide', 'canvas-doc-substrate', 'canvas-structured-output',
     'canvas-bash-valve',
 ];
 const HISTORICAL_CANVAS_EXTENSION_PREFIXES = [
+    [
+        'canvas-inbox-watcher', 'canvas-stophook', 'canvas-recap',
+        'canvas-goal-capture', 'canvas-passive-context', 'canvas-review-boundary',
+        'canvas-context-intro',
+        'canvas-tool-guide', 'canvas-doc-substrate', 'canvas-structured-output',
+        'canvas-bash-valve',
+    ],
     [
         'canvas-inbox-watcher', 'canvas-stophook', 'canvas-recap',
         'canvas-goal-capture', 'canvas-passive-context', 'canvas-context-intro',

package/dist/core/canvas/index.d.ts

@@ -6,6 +6,5 @@ export * from './source.js';
 export * from './history.js';
 export * from './focuses.js';
 export * from './crons.js';
-export * from './human-work-outbox.js';
 export * from './telemetry.js';
 export { openDb, closeDb } from './db.js';

package/dist/core/canvas/index.js

@@ -8,6 +8,5 @@ export * from './source.js';
 export * from './history.js';
 export * from './focuses.js';
 export * from './crons.js';
-export * from './human-work-outbox.js';
 export * from './telemetry.js';
 export { openDb, closeDb } from './db.js';

package/dist/core/canvas/nav-model.d.ts

@@ -10,7 +10,7 @@ export declare function cSubscriptions(id: string): SubscriptionRef[];
 export declare function cSubscribers(id: string): SubscriptionRef[];
 /** First manager (by created) — the UP step for the ancestry spine. */
 export declare function managerOf(id: string): string | undefined;
-/** A kind:'human' node is a control-plane ASK (a humanloop deck on the human's
+/** A kind:'human' node is a control-plane ASK (a deck on the human's
  *  screen), NOT a pi conversation — it has no session, so focusing/reviving it
  *  boots a confused blank "you have been revived" pi. Its pending-ask signal
  *  already rides the ⚑ badge on the ASKING node (attention.ts follows the

package/dist/core/canvas/nav-model.js

@@ -101,7 +101,7 @@ export function cSubscribers(id) {
 export function managerOf(id) {
     return cSubscribers(id)[0]?.node_id;
 }
-/** A kind:'human' node is a control-plane ASK (a humanloop deck on the human's
+/** A kind:'human' node is a control-plane ASK (a deck on the human's
  *  screen), NOT a pi conversation — it has no session, so focusing/reviving it
  *  boots a confused blank "you have been revived" pi. Its pending-ask signal
  *  already rides the ⚑ badge on the ASKING node (attention.ts follows the

package/dist/core/canvas/paths.d.ts

@@ -16,6 +16,11 @@ export declare function canvasDbPath(): string;
  *  it binds. */
 export declare function viewSocketPath(nodeId: string): string;
 export declare function nodesRoot(): string;
+export declare function reviewsRoot(): string;
+export declare function reviewDir(reviewId: string): string;
+export declare function reviewBranchPath(reviewId: string): string;
+export declare function reviewResultPath(reviewId: string): string;
+export declare function ensureReviewDir(reviewId: string): void;
 /** Absolute path to crtrd's API listener unix socket, a sibling of
  *  `canvasDbPath()` under the canvas home (`~/.crouter/canvas/crtrd.sock` unless
  *  `CRTR_HOME` is set). Pure path builder — no db reach — so both the daemon

package/dist/core/canvas/paths.js

@@ -47,6 +47,22 @@ export function viewSocketPath(nodeId) {
 export function nodesRoot() {
     return join(crtrHome(), 'nodes');
 }
+export function reviewsRoot() {
+    return join(crtrHome(), 'reviews');
+}
+export function reviewDir(reviewId) {
+    assertSafeNodeId(reviewId);
+    return join(reviewsRoot(), reviewId);
+}
+export function reviewBranchPath(reviewId) {
+    return join(reviewDir(reviewId), 'branch-point.jsonl');
+}
+export function reviewResultPath(reviewId) {
+    return join(reviewDir(reviewId), 'result.json');
+}
+export function ensureReviewDir(reviewId) {
+    mkdirSync(reviewDir(reviewId), { recursive: true, mode: 0o700 });
+}
 /** Absolute path to crtrd's API listener unix socket, a sibling of
  *  `canvasDbPath()` under the canvas home (`~/.crouter/canvas/crtrd.sock` unless
  *  `CRTR_HOME` is set). Pure path builder — no db reach — so both the daemon

package/dist/core/canvas/remote-canvas-source.js

@@ -1,5 +1,5 @@
 // remote-canvas-source.ts — a CanvasSource backed by a remote canvas over the
-// relay-token-authed `/__crtr/source` transport (see `transport-remote.ts`).
+// relay-token-authed `/__crtr/source` transport (see `remote-transport.ts`).
 // Every method shells out to an EXISTING `crtr --json <subcommand>` in-guest —
 // no new in-guest command, no remote SQLite read, no drive-plane verb. A
 // short-TTL cache coalesces the fan-out a single browse/inspect frame would
@@ -10,7 +10,7 @@
 // crtrd `/v1` API. Repointing remote canvases at a crtrd proxy shell is a P2
 // item; until then this subsystem is a settled, intentional exception to the
 // "every process is a /v1 client" architecture (which governs LOCAL access).
-import { createRemoteExec } from '../view/transport-remote.js';
+import { createRemoteExec } from './remote-transport.js';
 const CACHE_TTL_MS = 1000;
 // ---------------------------------------------------------------------------
 // Remote JSON shape validation.

package/dist/core/canvas/remote-transport.d.ts

@@ -0,0 +1,7 @@
+export interface RemoteExecResponse {
+    ok: boolean;
+    exitCode?: number;
+    stdout: string;
+    stderr: string;
+}
+export declare function createRemoteExec(previewEndpoint: string, relayToken: string, timeoutMs?: number): (bin: string, args: string[]) => Promise<RemoteExecResponse>;

package/dist/core/{view/transport-remote.js → canvas/remote-transport.js}

@@ -1,7 +1,6 @@
-// transport-remote.ts — the Node-side remote exec transport for a
-// RemoteCanvasSource. POSTs a SourceRequest to a Blaxel preview endpoint's
-// `/__crtr/source` route (the SAME in-guest source-fulfillment endpoint the
-// browser/web transport already speaks), bearer-authed with the relay token.
+// remote-transport.ts — the Node-side remote exec transport for a
+// RemoteCanvasSource. POSTs an exec request to a Blaxel preview endpoint's
+// `/__crtr/source` route, bearer-authed with the relay token.
 //
 // This is the ONLY way RemoteCanvasSource reaches the remote canvas: it never
 // reads a remote SQLite file, and it never invokes an in-guest command that

package/dist/core/canvas/source.js

@@ -1,7 +1,7 @@
 import { getNode, getRow, listNodes, subscriptionsOf, subscribersOf, view, hasActiveLiveSubscription, } from './canvas.js';
 import { ticketCountsForNodes } from './attention.js';
 import { readState } from '../config.js';
-import { resolveRemoteCanvasTarget } from '../view/remote-canvas-target.js';
+import { resolveRemoteCanvasTarget } from '../remote-canvas-target.js';
 import { RemoteCanvasSource } from './remote-canvas-source.js';
 export class LocalCanvasSource {
     async getNode(nodeId) {

package/dist/core/canvas/status-glyph.js

@@ -1,14 +1,6 @@
-// status-glyph.ts — the canonical status→glyph/color map + overlay resolution
-// for the TS canvas-GRAPH surfaces (the ASCII forest `render.ts` and the
-// interactive `browse/render.ts`). It replaces the copy-pasted STATUS_GLYPH /
-// STATUS_COLOR literals those two files used to carry.
-//
-// SCOPE: only the surfaces the hanging-node feature touches. The workspace rail,
-// feed/push roster, and attach chat-view keep their own glyph copies (out of
-// scope). The portable `.mjs` canvas monitor view CANNOT import this (TS dist) —
-// it carries its own mirrored map with a pointer back to fault.ts.
-//
-// OVERLAY PRECEDENCE: hanging > streaming > status. `hanging` and `streaming` are
+// status-glyph.ts — the canonical status glyph and color map used by the canvas
+// ASCII forest and interactive browser. The overlay precedence is
+// hanging > streaming > status. `hanging` and `streaming` are
 // mutually exclusive in practice (hanging means the turn ended, so `busy` is
 // gone) but the precedence is defined regardless.
 import { FAULT_QUIET_MS } from '../runtime/fault.js';
@@ -20,7 +12,7 @@ export const STATUS_GLYPH = {
     dead: '✗',
     canceled: '⊘',
 };
-// ── Status hue: numeric SGR codes per status (lifted from browse/render.ts). ───
+// ── Status hue: numeric SGR codes per status. ─────────────────────────────────
 // Reinforces the glyph; the glyph SHAPE stays the NO_COLOR carrier.
 export const STATUS_COLOR = {
     active: 32, // green

package/dist/core/canvas/types.d.ts

@@ -56,30 +56,14 @@ export interface ManagedWorktree {
     created: string;
     closed?: string;
 }
-/** The private human task a lifecycle-owned fork answers. The discriminator is
- *  deliberately closed over the two supported lanes; adding another private
- *  worker kind requires an explicit contract rather than an untyped target. */
-export type HumanWorkTarget = {
-    work_kind: 'follow_up';
-    dir: string;
-    request_id: string;
-    root: string;
-} | {
-    work_kind: 'visual';
-    dir: string;
-    request_id: string;
-    root: string;
-};
-/** Whether a private human-work fork still needs its first writable Pi session
- *  created from immutable provenance, or has bound that child session and can
- *  only resume it. */
-export type PrivateForkPhase = 'fork_pending' | 'session_started';
-/** The one-shot portion of a private fork's persisted launch recipe. The other
- *  immutable recipe facts stay in their existing canonical fields:
- *  `NodeIdentity.fork_from` is the absolute provenance file and
- *  `LaunchSpec.model` with `modelExact` is the exact runtime selection. */
-export interface PrivateForkRecipe {
-    kickoff: string;
+/** Immutable review-companion provenance. The origin session/leaf/model
+ *  coordinates remain canonical in the review row rather than being duplicated
+ *  into node metadata. */
+export interface ReviewBinding {
+    review_id: string;
+    origin_node_id: string;
+    branch_file: string;
+    target_file: string;
 }
 /** A node's DURABLE IDENTITY — the subset that `meta.json` persists on disk.
  *  Written rarely (birth, polymorph, session-id capture, naming); never touched
@@ -147,17 +131,8 @@ export interface NodeIdentity {
      *  (without it a fork impersonates its source). Undefined for a fresh node;
      *  identity/audit only. */
     fork_from?: string | null;
-    /** Immutable private-human-work binding. Delivery remains owned by the
-     *  corresponding outbox protocol; this target identifies what the private
-     *  lifecycle child exists to answer. Undefined for ordinary nodes. */
-    human_work_target?: HumanWorkTarget | null;
-    /** Private fork birth is explicit across the pre-session crash boundary.
-     *  `fork_pending` launches only from the immutable provenance + kickoff;
-     *  `session_started` launches only from the bound child session. */
-    private_fork_phase?: PrivateForkPhase | null;
-    /** Persisted one-shot kickoff for `fork_pending`; ignored after the child
-     *  session is bound. See `PrivateForkRecipe` for the rest of the recipe. */
-    private_fork_recipe?: PrivateForkRecipe | null;
+    /** Immutable review-companion binding. Undefined for ordinary nodes. */
+    review_binding?: ReviewBinding | null;
     /** New subscriptions this node opens default to passive when true. */
     passive_default?: boolean;
     /** The pi session id for `--session <id>` revival. */

package/dist/core/clipboard-text.d.ts

@@ -1,3 +1,11 @@
 /** Write `text` to the system clipboard. Returns true on success, false when no
  *  clipboard tool is available or every attempt failed. Never throws. */
 export declare function writeClipboardText(text: string): boolean;
+/** Write `text` to the system clipboard AND, inside tmux, to the tmux paste
+ *  buffer via `tmux load-buffer -w -` (which makes tmux emit OSC 52 outward on
+ *  the app's behalf). Never emits OSC 52 from this process. Never throws.
+ *  Returns which operations succeeded. */
+export declare function writeClipboardTextEverywhere(text: string): {
+    system: boolean;
+    tmux: boolean;
+};

package/dist/core/clipboard-text.js

@@ -37,3 +37,21 @@ export function writeClipboardText(text) {
     }
     return false;
 }
+/** Write `text` to the system clipboard AND, inside tmux, to the tmux paste
+ *  buffer via `tmux load-buffer -w -` (which makes tmux emit OSC 52 outward on
+ *  the app's behalf). Never emits OSC 52 from this process. Never throws.
+ *  Returns which operations succeeded. */
+export function writeClipboardTextEverywhere(text) {
+    const system = writeClipboardText(text);
+    let tmux = false;
+    if (process.env.TMUX !== undefined) {
+        const result = spawnSync('tmux', ['load-buffer', '-w', '-'], {
+            input: text,
+            timeout: SPAWN_TIMEOUT_MS,
+            encoding: 'utf-8',
+        });
+        // Success if no error and exit status 0.
+        tmux = !result.error && result.status === 0;
+    }
+    return { system, tmux };
+}

package/dist/core/command-manifests/registry.d.ts

@@ -25,9 +25,7 @@ export interface ContributorIssue extends CommandManifestIssue {
     contributor: CommandContributorRef;
 }
 /** Invocation-local registry snapshot after collision resolution: the accepted
- *  contributions and every discovered issue. The amended spec has no freshness
- *  machinery, so there is no owner-routing map — an unknown-token miss hydrates
- *  ALL absent-store registrations once (§5.1), never a single known owner. */
+ *  contributions and every discovered issue. */
 export interface CommandRegistrySnapshot {
     /** Accepted top-level contributions, deterministically ordered by
      *  contributor name. */

package/dist/core/command-plugins/bundle.d.ts

@@ -0,0 +1,29 @@
+import { type ValidatedCommandManifest } from '../command-manifests/manifest.js';
+export interface BundleIssue {
+    code: string;
+    path?: string;
+    message: string;
+    received: string;
+    expected: string;
+    next: string;
+}
+export interface ValidatedBundle {
+    bundleVersion: 1;
+    commands: ValidatedCommandManifest;
+    commandsBytes: Uint8Array;
+    directories: ReadonlyArray<{
+        path: string;
+    }>;
+    memory: ReadonlyArray<{
+        path: string;
+        bytes: Uint8Array;
+    }>;
+}
+export interface PluginBundleValidation {
+    bundle?: ValidatedBundle;
+    issues: BundleIssue[];
+}
+/** Validate a Core-served plugin directory archive entirely in memory. */
+export declare function validatePluginBundle(archive: Uint8Array, options: {
+    reservedCoreNames: ReadonlySet<string>;
+}): Promise<PluginBundleValidation>;