@north-light/crouter 0.3.173 → 0.3.175

package/dist/clients/attach/slash/dispatch.d.ts

@@ -1,6 +1,7 @@
 import type { AutocompleteItem, SlashCommand } from '@earendil-works/pi-tui';
 import type { CopyTarget } from '../render/transcript-copy.js';
-import type { BrokerSnapshot, ClientRole, ClientToBroker } from '../../../core/runtime/broker-protocol.js';
+import { type ViewerCapabilities } from '../input/capabilities.js';
+import type { BrokerSnapshot, ClientToBroker } from '../../../core/runtime/broker-protocol.js';
 /** Everything a slash handler needs: the frame sink, a notice sink, the latest
  *  engine state (for read-only commands like `/session`), and the cwd (for the
  *  default `/export` path). */
@@ -13,27 +14,8 @@ export interface SlashContext {
     state?: BrokerSnapshot['state'];
     /** cwd for the default `/export` path; defaults to `process.cwd()`. */
     cwd?: string;
-    /** True for a REMOTE attach (`crtr surface attach --canvas <name>`). The
-     *  native canvas commands that shell a LOCAL `crtr` mutation/read against
-     *  `nodeId` (`/promote`, `/resume-node`, `/context`) are meaningless — or
-     *  worse, id-colliding — for a remote node id, so `dispatchCanvasCommand`
-     *  notifies + no-ops them instead of executing (see `REMOTE_UNSAFE_CANVAS_NAMES`
-     *  below). Defaults to `false` so every existing local caller is unaffected. */
-    remote?: boolean;
-    /** This viewer's FIXED capability, resolved once for the hello handshake
-     *  (`resolveHelloRole`) and never renegotiated. `'observer'` (`--observer`,
-     *  and every remote attach) makes the viewer read-only: the commands that
-     *  drive the engine or mutate the node through the crtr CLI are refused with
-     *  a notice, while the read-only/viewer-local ones stay live. Absent →
-     *  `'controller'`, so every existing writable caller is unaffected. */
-    role?: ClientRole;
-    /** The canvas node this viewer is attached to — used by `/promote` (passed
-     *  as `--node`). Falls back to `CRTR_NODE_ID` when absent; if neither is set
-     *  `/promote` notifies and no-ops. (Unit Q wires this from `runAttach`.) */
-    nodeId?: string;
-    /** The attached node's selected profile. `/resume-node` passes it to canvas
-     *  browse so the resume page opens within this identity. */
-    profileId?: string;
+    /** The session's viewer authority. */
+    capabilities: ViewerCapabilities;
     /** Toggle the in-process GRAPH overlay (the local subscription-tree view).
      *  `/graph` is inherently an in-viewer overlay, not a tmux popup, so this unit
      *  registers `/graph` as a stub that calls this hook. Unit C/Q owns the overlay
@@ -99,11 +81,6 @@ export declare const CANVAS_SLASH_COMMANDS: ReadonlyArray<{
     name: string;
     description: string;
 }>;
-/** The same gate, entered from raw editor text: the InputController asks BEFORE
- *  dispatching so a refused command is reported without reaching command
- *  dispatch. Unrecognized (extension) commands answer `undefined` here — they
- *  ride the normal `prompt` path, which the controller's own drive gate covers. */
-export declare function readOnlySlashRefusal(text: string, ctx: SlashContext): string | undefined;
 /** Every leading-command name this viewer consumes ENTIRELY locally — the
  *  message never reaches the engine as prose, whether dispatched or blocked
  *  with a notice (a remote-unsafe canvas/builtin command still returns
@@ -129,12 +106,12 @@ export declare function dispatchSlashCommand(text: string, ctx: SlashContext): b
  *  broker's `get_commands` result, which T7 may inject) — defaults to the
  *  vendored builtins. The native canvas commands are always appended (minus the
  *  remote-unsafe ones when `remote`). Shaped for pi-tui's `CombinedAutocompleteProvider`. */
-export declare function slashCommandList(commands?: ReadonlyArray<{
+export declare function slashCommandList(commands: ReadonlyArray<{
     name: string;
     description?: string;
-}>, remote?: boolean): SlashCommand[];
+}> | undefined, capabilities: ViewerCapabilities): SlashCommand[];
 /** Same list as flat autocomplete items (value/label/description). */
-export declare function commandAutocompleteItems(commands?: ReadonlyArray<{
+export declare function commandAutocompleteItems(commands: ReadonlyArray<{
     name: string;
     description?: string;
-}>, remote?: boolean): AutocompleteItem[];
+}> | undefined, capabilities: ViewerCapabilities): AutocompleteItem[];

package/dist/clients/attach/slash/dispatch.js

@@ -24,6 +24,7 @@
 import { execFile } from 'node:child_process';
 import { BUILTIN_SLASH_COMMANDS } from '../../../core/runtime/pi-vendored.js';
 import { surfaceTmuxStyleArgs } from '../../../core/runtime/surface-bg.js';
+import { viewerOperationForSlash } from '../input/capabilities.js';
 /** Canvas slash-commands — implemented NATIVE in the viewer, the ONLY live host:
  *  the broker binds mode:'rpc', so broker pi-extensions never run their
  *  interactive (mode==='tui') paths. `/promote` triggers a turn after shelling
@@ -49,24 +50,6 @@ export const CANVAS_SLASH_COMMANDS = [
     { name: 'fold-tools', description: 'View setting — fold every FINISHED tool call to its single call line (Alt+C → z → f)' },
 ];
 const CANVAS_NAMES = new Set(CANVAS_SLASH_COMMANDS.map((c) => c.name));
-/** Native canvas commands that shell a LOCAL `crtr` mutation or read against
- *  `ctx.nodeId` — unsafe for a remote attach: `/promote` shells `crtr node
- *  promote --node` locally, `/resume-node` opens local `crtr canvas browse`
- *  whose Enter path focuses a local node, and `/context` opens local `crtr node
- *  inspect context`. `/graph` stays available because its in-process overlay
- *  handles remote canvases directly. */
-const REMOTE_UNSAFE_CANVAS_NAMES = new Set(['promote', 'resume-node', 'context', 'node-metadata', 'rename', 'clear', 'mcp', 'inbox']);
-/** Native canvas commands an OBSERVER may not run — the ones that drive the
- *  engine or mutate the node, whether by frame or by shelling the crtr CLI:
- *  `/clear` sends `new_session`; `/promote` shells `crtr node promote` and then
- *  triggers a turn; `/rename` sends `set_session_name` and shells `crtr node
- *  config --name`; `/resume-node` opens the navigator whose Enter path focuses
- *  (and so revives) a node; `/mcp`'s panel actions ride a `prompt` frame into
- *  the engine. Deliberately NOT here — genuinely read-only or viewer-local:
- *  `/graph` (in-process overlay), `/context` and `/node-metadata` (read-only
- *  inspection popups), `/color` (this pane's tmux border + this viewer's name
- *  chip). */
-const OBSERVER_UNSAFE_CANVAS_NAMES = new Set(['clear', 'promote', 'rename', 'resume-node', 'mcp']);
 /** tmux named colours accepted by `/color` (plus `colourN`/`#rrggbb`, validated
  *  by pattern). Mirrors tmux's colour-name table so a typo is rejected with the
  *  options rather than silently ignored by tmux. */
@@ -93,52 +76,15 @@ const THINKING_LEVELS = new Set(Object.keys({
     max: true,
 }));
 const BUILTIN_NAMES = new Set(BUILTIN_SLASH_COMMANDS.map((c) => c.name));
-/** Builtin slash commands safe to run from a READ-ONLY viewer — a REMOTE
- *  attach (`--canvas`) or an `--observer` one —
- *  everything else in `BUILTIN_SLASH_COMMANDS` either drives the engine
- *  (`/model`, `/new`, `/compact`, `/name`, `/resume`, `/fork`, `/tree`,
- *  `/settings`, `/share`, `/clone`, `/import`, `/reload`, `/scoped-models`
- *  selection) or is viewer-local but operates on the WRONG host for a remote
- *  node (`/login`, `/logout` — LOCAL `auth.json` via `defaultAgentDir()`, not
- *  the remote broker's; for an observer, credentials it may not swap under a
- *  running engine). Blocked BEFORE the switch so a read-only viewer never even
- *  opens the picker only to have the eventual selection frame swallowed by
- *  InputController's `emitCommand` gate (defense-in-depth #2, not the only
- *  defense — see input/controller.ts DRIVE_FRAME_TYPES). */
-const READ_ONLY_SAFE_BUILTIN_NAMES = new Set(['copy', 'session', 'changelog', 'hotkeys', 'quit']);
-/** THE capability gate for a read-only viewer, keyed on the two fixed facts a
- *  session resolves once (`remote`, `role`) — so the answer for a given command
- *  cannot change mid-session. Returns the refusal notice, or `undefined` when
- *  this viewer may run the command. Both `dispatchSlashCommand` (so a direct
- *  caller is safe) and the InputController's submit path (so a refusal is
- *  reported before command dispatch) consult this one function; there is no
- *  second policy anywhere. */
-function readOnlyRefusal(name, ctx) {
-    const canvas = CANVAS_NAMES.has(name);
-    const builtinUnsafe = BUILTIN_NAMES.has(name) && !READ_ONLY_SAFE_BUILTIN_NAMES.has(name);
-    if (ctx.remote === true) {
-        if (canvas && REMOTE_UNSAFE_CANVAS_NAMES.has(name)) {
-            return `/${name} is not available for a remote attach (--canvas) — it acts on this machine's local canvas`;
-        }
-        if (builtinUnsafe)
-            return `/${name} is not available for a remote attach (--canvas) — view-only`;
-    }
-    if (ctx.remote !== true && (ctx.role ?? 'controller') !== 'controller') {
-        if ((canvas && OBSERVER_UNSAFE_CANVAS_NAMES.has(name)) || builtinUnsafe) {
-            return `/${name} is not available to a read-only observer attach (--observer) — it would drive this node`;
-        }
-    }
-    return undefined;
+function nodeIdFor(ctx) {
+    return ctx.capabilities.nodeId;
 }
-/** The same gate, entered from raw editor text: the InputController asks BEFORE
- *  dispatching so a refused command is reported without reaching command
- *  dispatch. Unrecognized (extension) commands answer `undefined` here — they
- *  ride the normal `prompt` path, which the controller's own drive gate covers. */
-export function readOnlySlashRefusal(text, ctx) {
-    const m = /^\/(\S+)\s*([\s\S]*)$/.exec(text.trim());
-    if (!m)
-        return undefined;
-    return readOnlyRefusal(m[1], ctx);
+function profileIdFor(ctx) {
+    return ctx.capabilities.profileId;
+}
+function readOnlyRefusal(name, ctx) {
+    const operation = viewerOperationForSlash(name, BUILTIN_NAMES.has(name), CANVAS_NAMES.has(name));
+    return operation === undefined ? undefined : ctx.capabilities.refusal(operation, name);
 }
 /** Every leading-command name this viewer consumes ENTIRELY locally — the
  *  message never reaches the engine as prose, whether dispatched or blocked
@@ -154,6 +100,10 @@ export function readOnlySlashRefusal(text, ctx) {
 export function locallyConsumedCommandNames() {
     return new Set([...BUILTIN_NAMES, ...CANVAS_NAMES, ...SCOPED_OUT]);
 }
+function parseSlashCommand(text) {
+    const match = /^\/(\S+)\s*([\s\S]*)$/.exec(text.trim());
+    return match === null ? undefined : { name: match[1], arg: match[2].trim() };
+}
 /** True if `text` is a leading-slash command (vs. a normal prompt). */
 export function isSlashCommand(text) {
     return text.trimStart().startsWith('/');
@@ -165,11 +115,10 @@ export function isSlashCommand(text) {
  * which the caller forwards to the engine as a `prompt` (extension command).
  */
 export function dispatchSlashCommand(text, ctx) {
-    const m = /^\/(\S+)\s*([\s\S]*)$/.exec(text.trim());
-    if (!m)
+    const command = parseSlashCommand(text);
+    if (command === undefined)
         return false;
-    const name = m[1];
-    const arg = m[2].trim();
+    const { name, arg } = command;
     if (SCOPED_OUT.has(name)) {
         ctx.notify(`/${name} is not supported in attach (Phase 4)`);
         return true;
@@ -323,24 +272,27 @@ export function dispatchSlashCommand(text, ctx) {
  *  present (so they survive whatever list Unit Q feeds in — builtins, or the
  *  broker's `get_commands` result). The canvas commands are viewer-owned,
  *  so they are always surfaced in autocomplete regardless of the source list —
- *  EXCEPT `REMOTE_UNSAFE_CANVAS_NAMES` when `remote`, which are structurally
- *  omitted rather than offered-then-blocked, so a remote attach's autocomplete
- *  never advertises a command `dispatchCanvasCommand` would refuse to run. */
-function withCanvasCommands(commands, remote) {
+ *  EXCEPT commands its capability object does not permit, which are structurally
+ *  omitted rather than offered-then-blocked, so autocomplete never advertises a
+ *  command `dispatchCanvasCommand` would refuse to run. */
+function withCanvasCommands(commands, capabilities) {
     const seen = new Set(commands.map((c) => c.name));
-    const offerable = remote ? CANVAS_SLASH_COMMANDS.filter((c) => !REMOTE_UNSAFE_CANVAS_NAMES.has(c.name)) : CANVAS_SLASH_COMMANDS;
-    return [...commands, ...offerable.filter((c) => !seen.has(c.name))];
+    const offerable = CANVAS_SLASH_COMMANDS.filter((command) => {
+        const operation = viewerOperationForSlash(command.name, false, true);
+        return operation === undefined || capabilities.permits(operation);
+    });
+    return [...commands, ...offerable.filter((command) => !seen.has(command.name))];
 }
 /** Build slash-command autocomplete entries from the merged command list (the
  *  broker's `get_commands` result, which T7 may inject) — defaults to the
  *  vendored builtins. The native canvas commands are always appended (minus the
  *  remote-unsafe ones when `remote`). Shaped for pi-tui's `CombinedAutocompleteProvider`. */
-export function slashCommandList(commands = BUILTIN_SLASH_COMMANDS, remote = false) {
-    return withCanvasCommands(commands, remote).map((c) => ({ name: c.name, description: c.description }));
+export function slashCommandList(commands, capabilities) {
+    return withCanvasCommands(commands ?? BUILTIN_SLASH_COMMANDS, capabilities).map((c) => ({ name: c.name, description: c.description }));
 }
 /** Same list as flat autocomplete items (value/label/description). */
-export function commandAutocompleteItems(commands = BUILTIN_SLASH_COMMANDS, remote = false) {
-    return withCanvasCommands(commands, remote).map((c) => ({ value: `/${c.name}`, label: `/${c.name}`, description: c.description }));
+export function commandAutocompleteItems(commands, capabilities) {
+    return withCanvasCommands(commands ?? BUILTIN_SLASH_COMMANDS, capabilities).map((c) => ({ value: `/${c.name}`, label: `/${c.name}`, description: c.description }));
 }
 // ---------------------------------------------------------------------------
 // Canvas commands — native reimplementations of the canvas chrome extensions.
@@ -447,7 +399,7 @@ function dispatchCanvasCommand(name, arg, ctx) {
  *  persona injector steers in the new-role guidance at the turn boundary — exactly
  *  as the node would by running the command itself. */
 function promoteNode(arg, ctx) {
-    const nodeId = (ctx.nodeId ?? process.env['CRTR_NODE_ID'] ?? '').trim();
+    const nodeId = nodeIdFor(ctx).trim();
     if (nodeId === '') {
         ctx.notify('/promote: no node to promote (viewer has no node id)');
         return;
@@ -507,7 +459,7 @@ function promoteNode(arg, ctx) {
  *  (visible with pane-border-status / terminal titles); (3) the canvas node row
  *  via `crtr node config --name`, which also renames the live viewer window. */
 function renameNode(arg, ctx) {
-    const nodeId = (ctx.nodeId ?? process.env['CRTR_NODE_ID'] ?? '').trim();
+    const nodeId = nodeIdFor(ctx).trim();
     if (nodeId === '') {
         ctx.notify('/rename: no node to rename (viewer has no node id)');
         return;
@@ -616,7 +568,8 @@ function resumeNode(ctx) {
         return true;
     }
     const cwd = shellQuote(ctx.cwd ?? process.cwd());
-    const profile = ctx.profileId === undefined || ctx.profileId === '' ? '' : ` --profile-id ${shellQuote(ctx.profileId)}`;
+    const profileId = profileIdFor(ctx);
+    const profile = profileId === undefined || profileId === '' ? '' : ` --profile-id ${shellQuote(profileId)}`;
     const cmd = `crtr canvas browse --return-pane ${origPane} --cwd ${cwd}${profile}`;
     popup(cmd);
     return true;
@@ -631,7 +584,7 @@ function openContext(ctx) {
     }
     // The popup runs server-side and won't reliably inherit CRTR_NODE_ID, so pass
     // this viewer's node id explicitly (mirrors /promote, /resume-node).
-    const nodeId = (ctx.nodeId ?? process.env['CRTR_NODE_ID'] ?? '').trim();
+    const nodeId = nodeIdFor(ctx).trim();
     if (nodeId === '') {
         ctx.notify('/context: no node to root on (viewer has no node id)');
         return true;