@north-light/crouter 0.3.170 → 0.3.172

package/dist/core/termrender/version.d.ts

@@ -0,0 +1 @@
+export declare const TERMRENDER_VERSION = "4.12.6";

package/dist/core/termrender/version.js

@@ -0,0 +1 @@
+export const TERMRENDER_VERSION = '4.12.6';

package/dist/core/tui/terminal.js

@@ -1,8 +1,7 @@
 // terminal.ts — raw-mode helpers shared by every crtr raw-ANSI TUI.
 //
 // Moved verbatim from src/core/canvas/browse/terminal.ts (it was already
-// generic). Hand-rolled (no deps), mirroring humanloop's src/tui/terminal.ts.
-// Extends its key parsing beyond up/down/return/escape/tab/backspace/ctrl +
+// generic). Hand-rolled (no deps). Extends basic key parsing beyond up/down/return/escape/tab/backspace/ctrl +
 // printable input: adds leftArrow/rightArrow (cursor keys) and shiftTab
 // (`\x1b[Z`) so callers can drive tree expand/collapse and tab cycling.
 function emptyKey() {

package/dist/core/user-settings.d.ts

@@ -92,7 +92,7 @@ export declare const CONFIG_SETTINGS_COVERAGE: {
             valueConstraint: string;
             applies: string;
             order: number;
-            format: (config: ScopeConfig) => "off" | "on";
+            format: (config: ScopeConfig) => "on" | "off";
             cycle: (config: ScopeConfig) => void;
             setFromString: (config: ScopeConfig, raw: string) => string | null;
         };
@@ -110,11 +110,47 @@ export declare const CONFIG_SETTINGS_COVERAGE: {
             valueConstraint: string;
             applies: string;
             order: number;
-            format: (config: ScopeConfig) => "off" | "on";
+            format: (config: ScopeConfig) => "on" | "off";
             cycle: (config: ScopeConfig) => void;
             setFromString: (config: ScopeConfig, raw: string) => string | null;
         };
     };
+    working_gerunds: {
+        surface: "specialized";
+        owner: string;
+    };
+    whip_mode: {
+        surface: "settings";
+        setting: {
+            key: "whip_mode";
+            label: string;
+            description: string;
+            valueConstraint: string;
+            applies: string;
+            order: number;
+            format: (config: ScopeConfig) => "on" | "off";
+            cycle: (config: ScopeConfig) => void;
+            setFromString: (config: ScopeConfig, raw: string) => string | null;
+        };
+    };
+    whip_messages: {
+        surface: "specialized";
+        owner: string;
+    };
+    mouse_mode_default: {
+        surface: "settings";
+        setting: {
+            key: "mouse_mode_default";
+            label: string;
+            description: string;
+            valueConstraint: string;
+            applies: string;
+            order: number;
+            format: (config: ScopeConfig) => "on" | "off" | "follow tmux";
+            cycle: (config: ScopeConfig, delta: number) => void;
+            setFromString: (config: ScopeConfig, raw: string) => string | null;
+        };
+    };
     live_cycles: {
         surface: "settings";
         setting: {
@@ -152,7 +188,35 @@ export declare const CONFIG_SETTINGS_COVERAGE: {
             valueConstraint: string;
             applies: string;
             order: number;
-            format: (config: ScopeConfig) => "off" | "on";
+            format: (config: ScopeConfig) => "on" | "off";
+            cycle: (config: ScopeConfig) => void;
+            setFromString: (config: ScopeConfig, raw: string) => string | null;
+        };
+    };
+    summarize_tool_calls: {
+        surface: "settings";
+        setting: {
+            key: "summarize_tool_calls";
+            label: string;
+            description: string;
+            valueConstraint: string;
+            applies: string;
+            order: number;
+            format: (config: ScopeConfig) => "on" | "off";
+            cycle: (config: ScopeConfig) => void;
+            setFromString: (config: ScopeConfig, raw: string) => string | null;
+        };
+    };
+    detailed_tool_recaps: {
+        surface: "settings";
+        setting: {
+            key: "detailed_tool_recaps";
+            label: string;
+            description: string;
+            valueConstraint: string;
+            applies: string;
+            order: number;
+            format: (config: ScopeConfig) => "on" | "off";
             cycle: (config: ScopeConfig) => void;
             setFromString: (config: ScopeConfig, raw: string) => string | null;
         };
@@ -161,6 +225,10 @@ export declare const CONFIG_SETTINGS_COVERAGE: {
         surface: "specialized";
         owner: string;
     };
+    tmux_passthrough: {
+        surface: "specialized";
+        owner: string;
+    };
     modelLadders: {
         surface: "specialized";
         owner: string;

package/dist/core/user-settings.js

@@ -1,4 +1,4 @@
-import { CONDENSED_HISTORY_MODES } from '../types.js';
+import { CONDENSED_HISTORY_MODES, MOUSE_MODE_DEFAULTS } from '../types.js';
 function cycleChoice(choices, current, delta) {
     const index = choices.indexOf(current);
     const start = index >= 0 ? index : 0;
@@ -164,6 +164,47 @@ export const CONFIG_SETTINGS_COVERAGE = {
             },
         },
     },
+    working_gerunds: { surface: 'specialized', owner: 'sys config set working_gerunds' },
+    whip_mode: {
+        surface: 'settings',
+        setting: {
+            key: 'whip_mode',
+            label: 'Whip mode',
+            description: 'Play the whip animation when you send a prompt and when an automatically opened child viewer starts.',
+            valueConstraint: 'true|false',
+            applies: 'Applies on the next attach.',
+            order: 39,
+            format: (config) => config.whip_mode ? 'on' : 'off',
+            cycle: (config) => { config.whip_mode = !config.whip_mode; },
+            setFromString: (config, raw) => {
+                const value = booleanFromString(raw, 'whip_mode');
+                if (typeof value === 'string')
+                    return value;
+                config.whip_mode = value;
+                return null;
+            },
+        },
+    },
+    whip_messages: { surface: 'specialized', owner: 'sys config set whip_messages' },
+    mouse_mode_default: {
+        surface: 'settings',
+        setting: {
+            key: 'mouse_mode_default',
+            label: 'Default mouse mode',
+            description: 'Initial mouse wheel scrolling for each attached viewer.',
+            valueConstraint: MOUSE_MODE_DEFAULTS.join('|'),
+            applies: 'Applies on the next attach.',
+            order: 38,
+            format: (config) => config.mouse_mode_default === 'tmux' ? 'follow tmux' : config.mouse_mode_default,
+            cycle: (config, delta) => { config.mouse_mode_default = cycleChoice(MOUSE_MODE_DEFAULTS, config.mouse_mode_default, delta); },
+            setFromString: (config, raw) => {
+                if (!MOUSE_MODE_DEFAULTS.includes(raw))
+                    return `mouse_mode_default must be one of: ${MOUSE_MODE_DEFAULTS.join('|')}`;
+                config.mouse_mode_default = raw;
+                return null;
+            },
+        },
+    },
     live_cycles: {
         surface: 'settings',
         setting: {
@@ -223,7 +264,48 @@ export const CONFIG_SETTINGS_COVERAGE = {
             },
         },
     },
+    summarize_tool_calls: {
+        surface: 'settings',
+        setting: {
+            key: 'summarize_tool_calls',
+            label: 'Summarize tool calls',
+            description: 'Replace completed folded tool-call groups with a one-line broker summary when available.',
+            valueConstraint: 'true|false',
+            applies: 'Applies when the next visible message closes a tool-call group.',
+            order: 35,
+            format: (config) => config.summarize_tool_calls ? 'on' : 'off',
+            cycle: (config) => { config.summarize_tool_calls = !config.summarize_tool_calls; },
+            setFromString: (config, raw) => {
+                const value = booleanFromString(raw, 'summarize_tool_calls');
+                if (typeof value === 'string')
+                    return value;
+                config.summarize_tool_calls = value;
+                return null;
+            },
+        },
+    },
+    detailed_tool_recaps: {
+        surface: 'settings',
+        setting: {
+            key: 'detailed_tool_recaps',
+            label: 'Detailed tool recaps',
+            description: 'Show each memory read and edited file in folded tool recaps. Off shows a compact count line instead.',
+            valueConstraint: 'true|false',
+            applies: 'Applies on the next attach.',
+            order: 36,
+            format: (config) => config.detailed_tool_recaps ? 'on' : 'off',
+            cycle: (config) => { config.detailed_tool_recaps = !config.detailed_tool_recaps; },
+            setFromString: (config, raw) => {
+                const value = booleanFromString(raw, 'detailed_tool_recaps');
+                if (typeof value === 'string')
+                    return value;
+                config.detailed_tool_recaps = value;
+                return null;
+            },
+        },
+    },
     keybindings: { surface: 'specialized', owner: 'Keybindings tab' },
+    tmux_passthrough: { surface: 'specialized', owner: 'Keybindings tab' },
     modelLadders: { surface: 'specialized', owner: 'Models tab' },
     modelRoutes: { surface: 'specialized', owner: 'Models route declarations' },
     modelRouting: { surface: 'specialized', owner: 'Models route declarations' },

package/dist/daemon/api/__tests__/inbox.test.js

@@ -2,43 +2,35 @@
 //
 // Integration coverage for crtrd's `/v1/human/inbox` routes
 // (inbox-contract.md §A, `handlers/inbox.ts`). Exercises the full leaf → typed
-// `CrtrClient` → in-process `createApiServer()` → handler → real
-// `@crouton-kit/humanloop` boundary — never a mock client, never a
-// pre-parsed handler call. Tickets live under a root registered directly
-// with humanloop's `registerInboxRoot`, isolated per test via a fresh
-// `XDG_STATE_HOME` (humanloop's root registry reads it live, so the SAME
-// running server picks up a fresh registry with no restart needed).
-//
-// Fixture policy: an ordinary pending ticket is created through humanloop's
-// public `submitDeck`/`submitReview` — the same surface a real caller uses.
-// A raw hand-written `deck.json`/`review.json` is used ONLY where the test's
-// whole point is a state `submitDeck`/`submitReview` cannot produce: a
-// stored ticket with an unresolved `bodyPath` (submit-time resolution
-// already inlines it), a tampered/malformed stored deck (simulating
-// mutation after enumeration), an adversarial root-replacement fixture, or a
-// deliberately raced foreign claim/resolution. Each such use is commented.
-import { test, describe, before, after, beforeEach, afterEach } from 'node:test';
+// `CrtrClient` → in-process `createApiServer()` → handler → ticket store —
+// never a mock client or pre-parsed handler call. Tickets live directly under
+// the derived `ticketsRoot()` and use the same public store APIs as production.
+// A raw hand-written `deck.json` is used only for states that submission cannot
+// produce: an unresolved `bodyPath`, a malformed stored deck, or a raced final.
+import { test, describe, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawn } from 'node:child_process';
-import { mkdtempSync, mkdirSync, rmSync, writeFileSync, readFileSync, existsSync, symlinkSync, } from 'node:fs';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync, readFileSync, existsSync, realpathSync, } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
-import { registerInboxRoot, submitDeck, submitReview, claimTicket, releaseClaim, deckPath, responsePath, notifyDeck, } from '@crouton-kit/humanloop';
+import { claimTicket, releaseClaim } from '../../../core/human/claim.js';
+import { deckPath, responsePath } from '../../../core/human/convention.js';
+import { notifyDeck } from '../../../core/human/deck-factories.js';
+import { ticketsRoot } from '../../../core/human/root.js';
+import { submitDeck, submitReview } from '../../../core/human/tickets.js';
 import { createApiServer } from '../server.js';
 import { apiSocketPath } from '../../../core/canvas/paths.js';
 import { CrtrClient, ApiError } from '../../../api/index.js';
 const TICKET_ID_PATTERN = /^[a-f0-9]{64}$/;
 // ---------------------------------------------------------------------------
-// Harness — one server for the whole file; a fresh humanloop root registry
-// (XDG_STATE_HOME) per test.
+// Harness — one server for the whole file; a fresh derived tickets root per
+// test.
 // ---------------------------------------------------------------------------
 let crtrHome;
 let priorCrtrHome;
-let priorXdgStateHome;
 let server;
 let client;
-let stateHome;
 async function waitForSocket(path) {
     for (let i = 0; i < 200; i++) {
         if (existsSync(path))
@@ -49,7 +41,6 @@ async function waitForSocket(path) {
 }
 before(async () => {
     priorCrtrHome = process.env['CRTR_HOME'];
-    priorXdgStateHome = process.env['XDG_STATE_HOME'];
     crtrHome = mkdtempSync(join(tmpdir(), 'crtr-inbox-home-'));
     process.env['CRTR_HOME'] = crtrHome;
     server = createApiServer();
@@ -63,29 +54,17 @@ after(async () => {
         process.env['CRTR_HOME'] = priorCrtrHome;
     else
         delete process.env['CRTR_HOME'];
-    if (priorXdgStateHome !== undefined)
-        process.env['XDG_STATE_HOME'] = priorXdgStateHome;
-    else
-        delete process.env['XDG_STATE_HOME'];
 });
 beforeEach(() => {
-    stateHome = mkdtempSync(join(tmpdir(), 'crtr-inbox-state-'));
-    process.env['XDG_STATE_HOME'] = stateHome;
-});
-afterEach(() => {
-    rmSync(stateHome, { recursive: true, force: true });
+    rmSync(ticketsRoot(), { recursive: true, force: true });
+    mkdirSync(ticketsRoot(), { recursive: true, mode: 0o700 });
 });
 // ---------------------------------------------------------------------------
 // Fixture helpers
 // ---------------------------------------------------------------------------
-function freshRoot(owner, withHandler = false) {
-    const dir = mkdtempSync(join(tmpdir(), 'crtr-inbox-root-'));
-    const reg = registerInboxRoot({
-        root: dir,
-        owner,
-        ...(withHandler ? { handler: { command: process.execPath, args: ['-e', ''] } } : {}),
-    });
-    return reg.root; // already canonical (realpathSync'd internally)
+function freshRoot(..._unused) {
+    mkdirSync(ticketsRoot(), { recursive: true, mode: 0o700 });
+    return realpathSync(ticketsRoot());
 }
 function deckJson(blockedSince, extra = {}) {
     return {
@@ -99,14 +78,14 @@ function deckJson(blockedSince, extra = {}) {
  *  normal fixture path for any test that just needs a valid, answerable
  *  ticket on disk. */
 function submitTestDeck(root, id, blockedSince, extra = {}) {
-    return submitDeck({ root, id, deck: deckJson(blockedSince, extra) }).dir;
+    return submitDeck({ dir: join(root, id), deck: deckJson(blockedSince, extra) }).dir;
 }
 /** Create a real pending review ticket through the public submission API. */
 function submitTestReview(root, id, blockedSince) {
     const srcDir = mkdtempSync(join(tmpdir(), 'crtr-inbox-review-src-'));
     const file = join(srcDir, 'plan.md');
     writeFileSync(file, '# Plan\n\nDo the thing.\n');
-    return submitReview({ root, id, review: { title: 'Review the plan', subtitle: 'Review the plan now so implementation can begin with confidence.', source: {}, file, blockedSince } }).dir;
+    return submitReview({ dir: join(root, id), review: { title: 'Review the plan', subtitle: 'Review the plan now so implementation can begin with confidence.', source: {}, file, blockedSince } }).dir;
 }
 /** RAW fixture writer — bypasses `submitDeck`'s own submit-time validation
  *  and body-path resolution entirely. Used ONLY to construct on-disk states
@@ -144,7 +123,7 @@ function assertKeys(obj, allowed, label) {
 }
 function assertSourceShape(source) {
     assert.equal(typeof source, 'object');
-    assertKeys(source, ['sessionName', 'askedBy', 'blockedSince', 'nodeId', 'visual'], 'DeckSourceDTO');
+    assertKeys(source, ['sessionName', 'askedBy', 'blockedSince', 'nodeId'], 'DeckSourceDTO');
 }
 function assertTicketSummaryShape(ticket) {
     assert.match(ticket.ticket_id, TICKET_ID_PATTERN);
@@ -221,18 +200,23 @@ function assertNoForbiddenContent(value, forbidden, path = '$') {
 // GET /v1/human/inbox — enumerate
 // ---------------------------------------------------------------------------
 describe('GET /v1/human/inbox — enumerate', () => {
-    test('mixed deck + review tickets sort newest blocked_since first, then ticket_id ascending; closed wire shape, no forbidden content', async () => {
+    test('mixed deck + review tickets preserve canonical-root hash ids while sorting newest first', async () => {
         const root = freshRoot('crouter');
+        // This is the pre-cutover opaque-id formula: canonical root + NUL + ticket
+        // basename. The single derived root retains that canonical root, so an id
+        // a client computed before root registration disappeared still resolves.
+        const olderDeckId = ticketIdFor(root, 'older-deck');
         submitTestDeck(root, 'older-deck', '2026-01-01T00:00:00.000Z');
         submitTestReview(root, 'newer-review', '2026-01-02T00:00:00.000Z');
         const list = await client.listHumanInbox();
         assertInboxListShape(list);
-        assertNoForbiddenContent(list, [root, stateHome]);
+        assertNoForbiddenContent(list, [root]);
         assert.equal(list.tickets.length, 2);
         assert.equal(list.tickets[0].kind, 'review', 'newer blocked_since sorts first');
         assert.equal(list.tickets[1].kind, 'deck');
         assert.equal(list.tickets[0].ticket_id, ticketIdFor(root, 'newer-review'));
-        assert.equal(list.tickets[1].ticket_id, ticketIdFor(root, 'older-deck'));
+        assert.equal(list.tickets[1].ticket_id, olderDeckId);
+        assert.equal((await client.getHumanInboxDeck(olderDeckId)).deck.title, 'Ship it?');
     });
     test('sorts by parsed instant across differing UTC offsets, not lexical string order', async () => {
         const root = freshRoot('crouter');
@@ -302,7 +286,7 @@ describe('GET /v1/human/inbox/:ticket_id', () => {
 // POST /v1/human/inbox/:ticket_id/respond
 // ---------------------------------------------------------------------------
 describe('POST /v1/human/inbox/:ticket_id/respond', () => {
-    test('persists the canonical humanloop.response/v2 result unchanged, matches stored response.json exactly, and dispatches completion delivery', async () => {
+    test('persists the canonical humanloop.response/v2 result unchanged and matches stored response.json exactly', async () => {
         const root = freshRoot('crouter', true);
         const dir = submitTestDeck(root, 'ask', '2026-01-01T00:00:00.000Z');
         const id = ticketIdFor(root, 'ask');
@@ -312,17 +296,12 @@ describe('POST /v1/human/inbox/:ticket_id/respond', () => {
         assert.deepEqual(result.responses, [{ id: 'q', selectedOptionId: 'yes' }]);
         const stored = JSON.parse(readFileSync(responsePath(dir), 'utf8'));
         assert.deepEqual(stored, result, 'the wire result is the stored humanloop response exactly, unreconstructed');
-        // Completion dispatch is async (spawns the registered handler); poll for
-        // the delivery marker rather than assuming it lands synchronously.
-        const deliveryFile = join(dir, 'delivery.json');
-        for (let i = 0; i < 100 && !existsSync(deliveryFile); i++)
-            await new Promise((r) => setTimeout(r, 25));
-        assert.ok(existsSync(deliveryFile), 'completion delivery was dispatched to the registered handler');
+        assert.ok(existsSync(responsePath(dir)), 'the canonical response remains the only ticket receipt');
     });
     test('ordinary notify acknowledgement — no special endpoint/shape', async () => {
         const root = freshRoot('crouter');
         const id_ = 'notify';
-        submitDeck({ root, id: id_, deck: notifyDeck('Build done', { subtitle: 'The build completed successfully, so the change is ready to review.' }) });
+        submitDeck({ dir: join(root, id_), deck: notifyDeck('Build done', { subtitle: 'The build completed successfully, so the change is ready to review.' }) });
         const id = ticketIdFor(root, 'notify');
         const result = await client.respondHumanInboxDeck(id, { responses: [{ id: 'notify', selectedOptionId: 'ok' }] });
         assert.equal(result.kind, 'deck');
@@ -340,20 +319,15 @@ describe('POST /v1/human/inbox/:ticket_id/respond', () => {
         await client.respondHumanInboxDeck(id, { responses: [{ id: 'q', selectedOptionId: 'yes' }] });
         await expectApiError(client.respondHumanInboxDeck(id, { responses: [{ id: 'q', selectedOptionId: 'no' }] }), 409, 'ticket_already_resolved');
     });
-    test('409 ticket_unavailable when a live foreign claim already holds the ticket', async () => {
+    test('a live foreign claim is taken over by the daemon finish path', async () => {
         const root = freshRoot('crouter');
         const dir = submitTestDeck(root, 'ask', '2026-01-01T00:00:00.000Z');
         const id = ticketIdFor(root, 'ask');
-        // Raw use of the claim API is the legitimate way to simulate a genuine
-        // live foreign claim.
         const foreignClaim = claimTicket(dir, { host: 'someone-else' });
         assert.ok(foreignClaim !== null, 'foreign claim acquired');
-        try {
-            await expectApiError(client.respondHumanInboxDeck(id, { responses: [{ id: 'q', selectedOptionId: 'yes' }] }), 409, 'ticket_unavailable');
-        }
-        finally {
-            releaseClaim(dir, foreignClaim.token);
-        }
+        const result = await client.respondHumanInboxDeck(id, { responses: [{ id: 'q', selectedOptionId: 'yes' }] });
+        assertDeckResultShape(result);
+        assert.equal(releaseClaim(dir, foreignClaim.token), false, 'the takeover released the replaced claim');
     });
     test('external cancel/resolve race: a resolution that lands between the precheck and claimTicket() reports ticket_already_resolved, never ticket_unavailable', async () => {
         const root = freshRoot('crouter');
@@ -458,7 +432,7 @@ describe('POST /v1/human/inbox/:ticket_id/respond', () => {
 // POST /v1/human/inbox/:ticket_id/cancel
 // ---------------------------------------------------------------------------
 describe('POST /v1/human/inbox/:ticket_id/cancel', () => {
-    test('default reason, actor is hardcoded human, matches stored response.json, dispatches completion delivery', async () => {
+    test('default reason and hardcoded human actor match stored response.json', async () => {
         const root = freshRoot('crouter', true);
         const dir = submitTestDeck(root, 'ask', '2026-01-01T00:00:00.000Z');
         const id = ticketIdFor(root, 'ask');
@@ -469,10 +443,7 @@ describe('POST /v1/human/inbox/:ticket_id/cancel', () => {
         assert.equal(result.actor, 'human');
         const stored = JSON.parse(readFileSync(responsePath(dir), 'utf8'));
         assert.deepEqual(stored, result, 'the wire result is the stored humanloop cancellation exactly, unreconstructed');
-        const deliveryFile = join(dir, 'delivery.json');
-        for (let i = 0; i < 100 && !existsSync(deliveryFile); i++)
-            await new Promise((r) => setTimeout(r, 25));
-        assert.ok(existsSync(deliveryFile), 'completion delivery was dispatched to the registered handler');
+        assert.ok(existsSync(responsePath(dir)), 'the canonical cancellation remains the only ticket receipt');
     });
     test('custom reason is honored; actor is always human regardless of any client-supplied field', async () => {
         const root = freshRoot('crouter');
@@ -482,10 +453,12 @@ describe('POST /v1/human/inbox/:ticket_id/cancel', () => {
         assert.equal(result.reason, 'changed my mind');
         assert.equal(result.actor, 'human');
     });
-    test('409 ticket_kind_unsupported for a review ticket', async () => {
+    test('recordless review cancellation returns the stored humanloop.cancel/v1 result', async () => {
         const root = freshRoot('crouter');
-        submitTestReview(root, 'rev', '2026-01-01T00:00:00.000Z');
-        await expectApiError(client.cancelHumanInboxTicket(ticketIdFor(root, 'rev')), 409, 'ticket_kind_unsupported');
+        const dir = submitTestReview(root, 'rev', '2026-01-01T00:00:00.000Z');
+        const result = await client.cancelHumanInboxTicket(ticketIdFor(root, 'rev'));
+        assertCanceledResultShape(result);
+        assert.deepEqual(JSON.parse(readFileSync(responsePath(dir), 'utf8')), result);
     });
     test('409 ticket_already_resolved after the ticket was already resolved via respond', async () => {
         const root = freshRoot('crouter');
@@ -514,65 +487,3 @@ describe('malformed ticket id syntax', () => {
         }
     });
 });
-// ---------------------------------------------------------------------------
-// Root filtering
-// ---------------------------------------------------------------------------
-describe('root filtering', () => {
-    test('a non-crouter-owned root never appears in enumeration and its ticket 404s on GET', async () => {
-        const root = freshRoot('humanloop');
-        submitTestDeck(root, 'ask', '2026-01-01T00:00:00.000Z');
-        const id = ticketIdFor(root, 'ask');
-        const list = await client.listHumanInbox();
-        assert.equal(list.tickets.length, 0);
-        await expectApiError(client.getHumanInboxDeck(id), 404, 'ticket_not_found');
-    });
-    test('a root that becomes unavailable disappears from enumeration and resolution', async () => {
-        const root = freshRoot('crouter');
-        submitTestDeck(root, 'ask', '2026-01-01T00:00:00.000Z');
-        const id = ticketIdFor(root, 'ask');
-        let list = await client.listHumanInbox();
-        assert.equal(list.tickets.length, 1);
-        rmSync(root, { recursive: true, force: true });
-        list = await client.listHumanInbox();
-        assert.equal(list.tickets.length, 0);
-        await expectApiError(client.getHumanInboxDeck(id), 404, 'ticket_not_found');
-    });
-    test('a registered root replaced by a symlink to an unrelated directory confers no authority (enumeration and resolution)', async () => {
-        const root = freshRoot('crouter');
-        submitTestDeck(root, 'legit', '2026-01-01T00:00:00.000Z');
-        // Adversarial fixture: after registration, the registered pathname is
-        // removed and replaced with a symlink to an unrelated directory that
-        // was never registered as a crouter-owned root. Only a raw fixture can
-        // construct this — no submission API models a compromised root.
-        const attackerDir = mkdtempSync(join(tmpdir(), 'crtr-inbox-attacker-'));
-        writeRawDeckTicket(attackerDir, 'attacker', deckJson('2026-01-01T00:00:00.000Z', { title: 'Attacker deck' }));
-        rmSync(root, { recursive: true, force: true });
-        symlinkSync(attackerDir, root);
-        const list = await client.listHumanInbox();
-        assert.equal(list.tickets.length, 0, 'the attacker-controlled target must not be exposed through the replaced pathname');
-        const attackerId = ticketIdFor(attackerDir, 'attacker');
-        await expectApiError(client.getHumanInboxDeck(attackerId), 404, 'ticket_not_found');
-    });
-});
-// ---------------------------------------------------------------------------
-// Opaque-id collision safety
-// ---------------------------------------------------------------------------
-describe('opaque-id collision safety', () => {
-    test('two crouter roots with tickets sharing the same basename resolve to distinct ids and correct decks', async () => {
-        const rootA = freshRoot('crouter');
-        const rootB = freshRoot('crouter');
-        submitTestDeck(rootA, 'dup', '2026-01-01T00:00:00.000Z', { title: 'From root A' });
-        submitTestDeck(rootB, 'dup', '2026-01-01T00:00:00.000Z', { title: 'From root B' });
-        const idA = ticketIdFor(rootA, 'dup');
-        const idB = ticketIdFor(rootB, 'dup');
-        assert.notEqual(idA, idB);
-        const list = await client.listHumanInbox();
-        assert.equal(list.tickets.length, 2);
-        const ids = list.tickets.map((t) => t.ticket_id).sort();
-        assert.deepEqual(ids, [idA, idB].sort());
-        const deckA = await client.getHumanInboxDeck(idA);
-        const deckB = await client.getHumanInboxDeck(idB);
-        assert.equal(deckA.deck.title, 'From root A');
-        assert.equal(deckB.deck.title, 'From root B');
-    });
-});

package/dist/daemon/api/handlers/human.d.ts

@@ -1,12 +1,2 @@
-import type { CompletionHandler } from '@crouton-kit/humanloop';
 import type { RouteTable } from '../router.js';
-/** A broker retains its sealed runtime generation across installs. Humanloop
- * freezes that generation's `_visual` argv into the request, while crtrd may
- * already run a newer sibling generation when the human opens the ticket.
- * Accept only a Node invocation of the same leaf from an immutable 64-hex
- * generation beneath the current handler's exact generations directory. The
- * command differs legitimately: CLI registrations use the system Node path,
- * while the daemon runs through crouter's stable copied-Node host. */
-export declare function trustedCrouterHandler(candidate: CompletionHandler | undefined, current: CompletionHandler, leaf: '_visual' | '_consult'): boolean;
-export declare function trustedCrouterVisualHandler(candidate: CompletionHandler | undefined, current?: CompletionHandler): boolean;
 export declare const humanRoutes: RouteTable;