@north-light/crouter 0.3.173 → 0.3.175

package/dist/core/canvas/remote-canvas-source.js

@@ -2,8 +2,8 @@
 // relay-token-authed `/__crtr/source` transport (see `remote-transport.ts`).
 // Every method shells out to an EXISTING `crtr --json <subcommand>` in-guest —
 // no new in-guest command, no remote SQLite read, no drive-plane verb. A
-// short-TTL cache coalesces the fan-out a single browse/inspect frame would
-// otherwise make into the same node.
+// short-TTL cache coalesces the repeated reads a single remote inspection or
+// dashboard render would otherwise make for the same node.
 //
 // P2 DEFERRAL (Stage-C, plan C-1/C-5): this remote path still targets the
 // `/__crtr/source` in-guest fulfillment endpoint on a preview host, NOT the
@@ -45,7 +45,7 @@ function isValidShowResponse(x) {
     if (!isPlainObject(paths) ||
         typeof paths['context_dir'] !== 'string' ||
         typeof paths['reports_dir'] !== 'string' ||
-        (paths['session_file'] !== null && typeof paths['session_file'] !== 'string'))
+        ('session_file' in paths && paths['session_file'] !== null && typeof paths['session_file'] !== 'string'))
         return false;
     if (typeof x['follow_up'] !== 'string')
         return false;
@@ -54,7 +54,7 @@ function isValidShowResponse(x) {
 /** A `reports`/`managers` entry (`RemoteShowResponse`) — validated per-element
  *  because `isValidShowResponse` only checks the array wrapper. Without this,
  *  a malformed neighbor (`null`, `{}`) survives into `subscriptionsOf`/
- *  `subscribersOf`'s `.map()` and node.ts's remote `show` passthrough render,
+ *  `subscribersOf`'s `.map()` and `node/inspect.ts`'s remote `show` passthrough render,
  *  both of which dereference `.node_id`/`.active` unguarded. */
 function isValidNeighborEntry(x) {
     return (isPlainObject(x) &&
@@ -67,8 +67,8 @@ function isValidNeighborEntry(x) {
 /** A `NodeRow` element from `node inspect list`'s `nodes` array — validated
  *  per-element because a remote success payload can be `{nodes:[null]}` (the
  *  outer array check alone lets that through). Requires the string identity/
- *  lifecycle fields browse's tree-building code dereferences unguarded
- *  (`browse/app.ts`'s `rebuildSnapshot`); the remaining nullable runtime
+ *  lifecycle fields local/API-backed row renderers dereference unguarded;
+ *  the remaining nullable runtime
  *  fields (host_kind, parent, pi_pid, ...) are left to cast through as-is. */
 function isValidNodeRow(x) {
     if (!isPlainObject(x))
@@ -94,13 +94,6 @@ export class RemoteCanvasSource {
         this.relayToken = relayToken;
         this.exec = createRemoteExec(previewEndpoint, relayToken);
     }
-    /** Drops every cached entry — called on a `RemoteEventStream` `'nodes'` (or
-     *  `'inbox'`) event so the next read re-fetches fresh state. */
-    invalidate() {
-        this.nodeCache.clear();
-        this.rosterCache.clear();
-        this.viewCache.clear();
-    }
     async execJson(args) {
         let raw;
         try {
@@ -127,7 +120,7 @@ export class RemoteCanvasSource {
         const raw = await this.execJson(['node', 'inspect', 'show', id]);
         // Sanitize reports/managers elements here (not just the outer array shape)
         // so both consumers — subscriptionsOf/subscribersOf's `.map()` below AND
-        // node.ts's remote `show` passthrough render — see only well-formed
+        // node/inspect.ts's remote `show` passthrough render — see only well-formed
         // neighbor entries, never a malformed one they'd dereference unguarded.
         const res = isValidShowResponse(raw)
             ? { ...raw, reports: raw.reports.filter(isValidNeighborEntry), managers: raw.managers.filter(isValidNeighborEntry) }
@@ -136,7 +129,7 @@ export class RemoteCanvasSource {
         return res;
     }
     /** The full passthrough object `node inspect show` produces — used by
-     *  `nodeShow`'s remote branch (`src/commands/node.ts`) to return the exact
+     *  `nodeShow`'s remote branch (`src/commands/node/inspect.ts`) to return the exact
      *  same shape a local read would, without re-deriving it. */
     async rawShow(id) {
         return this.fetchShow(id);

package/dist/core/command.js

@@ -18,18 +18,25 @@ import { resolve } from 'node:path';
 // ---------------------------------------------------------------------------
 // Factory functions
 // ---------------------------------------------------------------------------
+function freezeCommandMetadata(value) {
+    if (value === null || typeof value !== 'object' || Object.isFrozen(value))
+        return value;
+    for (const child of Object.values(value))
+        freezeCommandMetadata(child);
+    return Object.freeze(value);
+}
 export function defineLeaf(opts) {
-    return {
+    return Object.freeze({
         kind: 'leaf',
         name: opts.name,
         description: opts.description,
         whenToUse: opts.whenToUse,
         tier: opts.tier,
-        help: opts.help,
-        slash: opts.slash,
+        help: freezeCommandMetadata(opts.help),
+        slash: opts.slash === undefined ? undefined : freezeCommandMetadata(opts.slash),
         run: opts.run,
         render: opts.render,
-    };
+    });
 }
 /** Number of a node's own non-hidden subcommands (direct children). Leaves and
  *  childless branches return 0. */

package/dist/core/config.js

@@ -452,7 +452,9 @@ function mergeConfig(partial) {
         : defaults.auto_open_child_viewers;
     const brokerThresholds = mergeBrokerThresholds(partial.brokerThresholds, defaults.brokerThresholds);
     const completion_bell = typeof partial.completion_bell === 'boolean' ? partial.completion_bell : defaults.completion_bell;
-    const working_gerunds = normalizeWorkingGerunds(partial.working_gerunds);
+    const working_gerunds = partial.working_gerunds === undefined
+        ? [...defaults.working_gerunds]
+        : normalizeWorkingGerunds(partial.working_gerunds);
     const whip_mode = typeof partial.whip_mode === 'boolean' ? partial.whip_mode : defaults.whip_mode;
     const whip_messages = normalizeWhipMessages(partial.whip_messages);
     const mouse_mode_default = MOUSE_MODE_DEFAULTS.includes(partial.mouse_mode_default)

package/dist/core/events/envelope.js

@@ -2,7 +2,7 @@ import { errorClassCodes, eventErrorFromUnknown } from './errors.js';
 import { generateOperationId, operationIdContext, validateOperationId } from './operation-id.js';
 const eventName = /^[a-z][a-z0-9]*(?:[._][a-z0-9]+)*$/;
 const levels = new Set(['error', 'warn', 'info', 'debug']);
-const components = new Set(['daemon', 'broker', 'web', 'control-plane', 'front', 'sentinel']);
+const components = new Set(['daemon', 'broker', 'control-plane', 'front', 'sentinel']);
 const outcomes = new Set(['succeeded', 'failed', 'skipped']);
 const dispositions = new Set(['auto', 'manual', 'fatal']);
 const classes = new Set(errorClassCodes);

package/dist/core/events/read.js

@@ -9,7 +9,6 @@ const MAX_CANONICAL_SOURCE_BYTES = 6 * 1024 * 1024;
 const MAX_RAW_SOURCE_BYTES = 256 * 1024;
 const MAX_CANONICAL_CONTENT_BYTES = MAX_EVENT_RECORD_BYTES - 1;
 const NO_FOLLOW_FLAG = typeof constants.O_NOFOLLOW === 'number' ? constants.O_NOFOLLOW : 0;
-const WEB_BASENAME = /^web\.([0-9a-f]{16})\.log\.jsonl(?:\.([12]))?$/;
 const EVENT_NAME = /^[a-z][a-z0-9]*(?:[._][a-z0-9]+)*$/;
 const CANONICAL_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
 const ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T/;
@@ -36,7 +35,7 @@ const TOP_LEVEL_KEYS = new Set([
     'dropped_fields_count',
 ]);
 const LEVELS = new Set(['debug', 'info', 'warn', 'error']);
-const COMPONENTS = new Set(['daemon', 'broker', 'web']);
+const COMPONENTS = new Set(['daemon', 'broker']);
 const OUTCOMES = new Set(['succeeded', 'failed', 'skipped']);
 const RETRY_DISPOSITIONS = new Set(['auto', 'manual', 'fatal']);
 const ERROR_CLASSES = new Set(errorClassCodes);
@@ -167,7 +166,7 @@ function forEachDirectoryEntry(proof, consume) {
             const entry = directory.readSync();
             if (entry === null)
                 break;
-            consume(entry.name);
+            consume(entry.name, entry.isDirectory());
         }
     }
     finally {
@@ -575,22 +574,6 @@ export function readLogSnapshot(query, includeRaw) {
         if (rawCompatible)
             scanRawSource(state, home, rootChain, join(home, 'crtrd.err'), 'daemon');
     }
-    if (selected(normalized, 'web')) {
-        forEachDirectoryEntry(root, (name) => {
-            const match = WEB_BASENAME.exec(name);
-            if (match === null)
-                return;
-            const streamId = match[1];
-            const generation = (match[2] === undefined ? 0 : Number(match[2]));
-            scanCanonicalSource(state, home, rootChain, {
-                component: 'web',
-                streamKey: `web:${streamId}`,
-                activeAbsolute: join(home, `web.${streamId}.log.jsonl`),
-                generation,
-                boundStreamId: streamId,
-            });
-        });
-    }
     const canonicalBroker = selected(normalized, 'broker');
     const rawBroker = rawCompatible && selected(normalized, 'broker');
     if (canonicalBroker || rawBroker) {
@@ -602,8 +585,11 @@ export function readLogSnapshot(query, includeRaw) {
                 scanBrokerNode(state, home, parents, normalized.nodeId, canonicalBroker, rawBroker);
             }
             else {
-                forEachDirectoryEntry(nodes, (nodeId) => {
-                    if (isSafeNodeId(nodeId))
+                forEachDirectoryEntry(nodes, (nodeId, isDirectory) => {
+                    // The node root may contain ordinary filesystem metadata such as
+                    // .DS_Store. Only a directory can be a node; proveDirectory still
+                    // revalidates it to reject a replacement or symlink race.
+                    if (isDirectory && isSafeNodeId(nodeId))
                         scanBrokerNode(state, home, parents, nodeId, canonicalBroker, rawBroker);
                 });
             }

package/dist/core/events/source.d.ts

@@ -7,8 +7,6 @@ export interface BoundEventSource {
 }
 export declare function bindDaemonEventSource(): void;
 export declare function bindBrokerEventSource(nodeId: string): void;
-export declare function webStreamId(host: string, port: number): string;
-export declare function bindWebEventSource(host: string, port: number): void;
 export declare function eventSource(): BoundEventSource | undefined;
 /** Test-only: clear the process-global binding. A single test process can
  * legitimately play several components in sequence (an in-process revive binds

package/dist/core/events/source.js

@@ -1,4 +1,3 @@
-import { createHash } from 'node:crypto';
 import { join } from 'node:path';
 import { crtrHome, isSafeNodeId, jobDir } from '../canvas/paths.js';
 let bound;
@@ -21,21 +20,6 @@ export function bindBrokerEventSource(nodeId) {
         throw new TypeError('node_id must be a non-empty path segment of at most 128 UTF-8 bytes');
     bind({ component: 'broker', node_id: nodeId, path: join(jobDir(nodeId), 'log.jsonl') });
 }
-function normalizeHost(host) {
-    const unbracketed = host.trim().toLowerCase().replace(/^\[|\]$/g, '');
-    if (unbracketed === '' || unbracketed === '0.0.0.0' || unbracketed === '::')
-        return 'localhost';
-    return unbracketed;
-}
-export function webStreamId(host, port) {
-    if (!Number.isInteger(port) || port < 0 || port > 65_535)
-        throw new TypeError('web port is invalid');
-    return createHash('sha256').update(`${normalizeHost(host)}\0${port}`).digest('hex').slice(0, 16);
-}
-export function bindWebEventSource(host, port) {
-    const stream_id = webStreamId(host, port);
-    bind({ component: 'web', stream_id, path: join(crtrHome(), `web.${stream_id}.log.jsonl`) });
-}
 export function eventSource() { return bound; }
 /** Test-only: clear the process-global binding. A single test process can
  * legitimately play several components in sequence (an in-process revive binds

package/dist/core/events/types.d.ts

@@ -1,5 +1,5 @@
 export type EventLevel = 'error' | 'warn' | 'info' | 'debug';
-export type EventComponent = 'daemon' | 'broker' | 'web' | 'control-plane' | 'front' | 'sentinel';
+export type EventComponent = 'daemon' | 'broker' | 'control-plane' | 'front' | 'sentinel';
 export type EventOutcome = 'succeeded' | 'failed' | 'skipped';
 export type RetryDisposition = 'auto' | 'manual' | 'fatal';
 export type OperationId = string & {

package/dist/core/fault-classifier.d.ts

@@ -1,5 +1,5 @@
 import type { ErrorClass, OperationId } from './events/types.js';
-export type FaultLink = 'pi→provider' | 'viewer↔broker' | 'relay↔broker' | 'browser↔relay' | 'cli→exa' | 'daemon→node' | 'crtr→pi';
+export type FaultLink = 'pi→provider' | 'viewer↔broker' | 'relay↔broker' | 'viewer↔crtrd' | 'cli→exa' | 'daemon→node' | 'crtr→pi';
 export type FaultKind = 'rate-limit' | 'overloaded' | 'connection' | 'auth' | 'protocol' | 'context-overflow' | 'other' | 'wedged' | 'model-not-found';
 export type FaultRetryDisposition = 'auto' | 'manual' | 'fatal';
 export type FaultRetryOwner = 'sdk' | 'daemon' | 'client';

package/dist/core/feed/passive.d.ts

@@ -1,14 +1,3 @@
 import { type InboxEntry, type InboxEntryInput } from './inbox.js';
 /** Atomically append one finalized entry to `nodes/<nodeId>/passive.jsonl`. */
 export declare function appendPassive(nodeId: string, entry: InboxEntryInput): InboxEntry;
-/** Return every accumulated passive entry (oldest first) without clearing. */
-export declare function readPassive(nodeId: string): InboxEntry[];
-/**
- * Read AND clear the accumulator in one shot — the drain-on-message primitive.
- *
- * We rename the file aside before reading so a concurrent `appendPassive` (a
- * publisher pushing at the same instant) starts a fresh file and is never lost
- * to the truncate: at worst it lands in the next drain. The renamed snapshot is
- * removed after a successful read. Returns the drained entries (oldest first).
- */
-export declare function drainPassive(nodeId: string): InboxEntry[];

package/dist/core/feed/passive.js

@@ -13,7 +13,7 @@
 //
 // Same entry shape as the inbox (InboxEntry) so the two stores stay symmetric
 // and a passive edge can be flipped active without reshaping data.
-import { appendFileSync, existsSync, readFileSync, renameSync, rmSync, mkdirSync, } from 'node:fs';
+import { appendFileSync, existsSync, mkdirSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { passivePath } from '../canvas/index.js';
 import { emitEvent } from '../events/emit.js';
@@ -51,64 +51,3 @@ function emitPassiveAppendFailure(nodeId, entry, error) {
         // Event emission is observational; the original append failure remains authoritative.
     }
 }
-/**
- * Parse jsonl text into entries, tolerating corruption: each line is parsed on
- * its own and a single malformed line is SKIPPED, never the whole feed. The
- * drain path renames + deletes its snapshot, so a non-tolerant parse here would
- * silently discard every accumulated entry the moment one bad line appears.
- */
-function parseEntries(text) {
-    const entries = [];
-    for (const line of text.split('\n')) {
-        if (line.trim() === '')
-            continue;
-        try {
-            entries.push(JSON.parse(line));
-        }
-        catch {
-            // Skip only the corrupt line — the rest of the feed survives.
-        }
-    }
-    return entries;
-}
-/** Return every accumulated passive entry (oldest first) without clearing. */
-export function readPassive(nodeId) {
-    const p = passivePath(nodeId);
-    if (!existsSync(p))
-        return [];
-    return parseEntries(readFileSync(p, 'utf8'));
-}
-/**
- * Read AND clear the accumulator in one shot — the drain-on-message primitive.
- *
- * We rename the file aside before reading so a concurrent `appendPassive` (a
- * publisher pushing at the same instant) starts a fresh file and is never lost
- * to the truncate: at worst it lands in the next drain. The renamed snapshot is
- * removed after a successful read. Returns the drained entries (oldest first).
- */
-export function drainPassive(nodeId) {
-    const p = passivePath(nodeId);
-    if (!existsSync(p))
-        return [];
-    const snapshot = `${p}.draining`;
-    try {
-        renameSync(p, snapshot);
-    }
-    catch {
-        // Lost the race (file vanished) — nothing to drain.
-        return [];
-    }
-    // Parse with the tolerant per-line parser BEFORE removing the snapshot, so a
-    // single corrupt line can never discard the whole accumulated feed.
-    let entries = [];
-    try {
-        entries = parseEntries(readFileSync(snapshot, 'utf8'));
-    }
-    finally {
-        try {
-            rmSync(snapshot, { force: true });
-        }
-        catch { /* best-effort cleanup */ }
-    }
-    return entries;
-}

package/dist/core/human/__tests__/{inbox-core.test.js → serial/inbox-core.test.js}

@@ -3,12 +3,12 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync,
 import { spawn } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { submitDeck, submitReview, completeDeck, cancelTicket, readTicketResult } from '../tickets.js';
-import { claimTicket } from '../claim.js';
-import { scanInbox } from '../scan.js';
-import { atomicWriteJson, progressPath, responsePath } from '../convention.js';
-import { validateDeck } from '../deck-schema.js';
-import { ticketDir } from '../root.js';
+import { submitDeck, submitReview, completeDeck, cancelTicket, readTicketResult } from '../../tickets.js';
+import { claimTicket } from '../../claim.js';
+import { scanInbox } from '../../scan.js';
+import { atomicWriteJson, progressPath, responsePath } from '../../convention.js';
+import { validateDeck } from '../../deck-schema.js';
+import { ticketDir } from '../../root.js';
 const temp = mkdtempSync(join(tmpdir(), 'crtr-inbox-core-'));
 process.env['CRTR_HOME'] = temp;
 const source = join(temp, 'source.md');

package/dist/core/keybindings/__tests__/resolve.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { ATTACH_CONTROL_BINDINGS, BINDING_CATALOG, KeybindingConcurrentEditError, KeybindingValidationError, SAFETY_REQUIREMENTS, canonicalTerminalStroke, formatStroke, matchesTerminalInput, normalizeGesture, normalizeSparseOverrides, persistUserKeybindings, resolveKeybindings, resolveUserKeybindings, } from '../index.js';
+import { KeybindingConcurrentEditError, KeybindingValidationError, canonicalTerminalStroke, matchesTerminalInput, normalizeSparseOverrides, persistUserKeybindings, resolveKeybindings, resolveUserKeybindings, } from '../index.js';
 import { readConfig } from '../../config.js';
 const typeCheckedBindingId = 'crtr.graph.down';
 // @ts-expect-error The catalog type rejects IDs that are not built in.
@@ -13,50 +13,6 @@ const rejectedAttachGlobalId = 'crtr.tmux.menu-global.attach';
 void typeCheckedBindingId;
 void rejectedBindingId;
 void rejectedAttachGlobalId;
-function ids(prefix, actions) {
-    return actions.map((action) => `${prefix}.${action}`);
-}
-function pairedMenuIds(actions) {
-    return actions.flatMap((action) => [`crtr.tmux.menu.${action}`, `crtr.tmux.menu-global.${action}`]);
-}
-function pairedAttachIds(pairs) {
-    return pairs.flatMap(([menuAction, directId]) => [`crtr.tmux.menu.attach.${menuAction}`, directId]);
-}
-const REQUIRED_IDS = [
-    'crtr.tmux.menu.open',
-    'crtr.tmux.menu.attach',
-    ...pairedMenuIds(['promote', 'resume', 'fork', 'demote', 'detach', 'close-subtree', 'background-bash', 'file-review', 'pin', 'show', 'view-settings', 'fold-tools', 'metadata', 'context', 'providers', 'graph', 'focus-manager', 'copy-id', 'reload-viewer', 'recap', 'issues', 'issue.idea', 'issue.bug']),
-    ...ids('crtr.tmux.node', ['next', 'previous']),
-    'crtr.tmux.inbox.toggle',
-    ...pairedAttachIds([
-        ['detach', 'crtr.attach.detach'],
-        ['clear-or-detach', 'crtr.attach.clear-or-detach'],
-        ['graph.toggle', 'crtr.attach.graph.toggle'],
-        ['help.toggle', 'crtr.attach.help.toggle'],
-        ['inbox.toggle', 'crtr.attach.inbox.toggle'],
-        ['model-ladder.next', 'crtr.attach.model-ladder.next'],
-        ['model-ladder.previous', 'crtr.attach.model-ladder.previous'],
-        ['command.inspect', 'crtr.attach.command.inspect'],
-        ['file-review', 'crtr.attach.file-review'],
-        ['profile-files', 'crtr.attach.profile-files'],
-        ['whip', 'crtr.attach.whip'],
-    ]),
-    ...ids('crtr.attach.scroll', ['up', 'down', 'page-up', 'page-down', 'live']),
-    'crtr.attach.mouse.toggle',
-    'crtr.attach.copy.message',
-    ...ids('crtr.graph', ['down', 'up', 'first', 'last', 'collapse-or-manager', 'expand-or-child', 'focus', 'revive', 'focus-manager', 'close-subtree', 'dismiss']),
-    ...ids('crtr.graph.confirm', ['accept', 'cancel']),
-    ...ids('crtr.inspector', ['force-quit', 'down', 'up', 'section-next', 'section-prev', 'page-down', 'page-up', 'toggle-detail', 'cancel-item', 'open-log', 'confirm', 'dismiss', 'retarget', 'refresh', 'quit']),
-    ...ids('crtr.browse', ['quit', 'down', 'up', 'first', 'last', 'expand-or-child', 'collapse-or-parent', 'toggle-fold', 'tab-next', 'tab-previous', 'tab.1', 'tab.2', 'tab.3', 'tab.4', 'tab.5', 'close-subtree', 'confirm-close', 'sort', 'scope', 'profile', 'residents', 'preview', 'search', 'revive-now', 'focus', 'focus-background']),
-    ...ids('crtr.browse.search', ['cancel', 'commit', 'delete', 'quit']),
-    ...ids('crtr.profile.menu', ['up', 'down', 'select', 'accept-default', 'abort', 'slot.1', 'slot.2', 'slot.3', 'slot.4', 'slot.5', 'slot.6', 'slot.7', 'slot.8', 'slot.9', 'create', 'search-existing', 'use-root', 'set-default', 'add-directory', 'unpin']),
-    ...ids('crtr.profile.search', ['up', 'down', 'pick', 'back', 'delete', 'abort']),
-    ...ids('crtr.setup', ['cancel', 'tab-next', 'tab-previous', 'open', 'list-down', 'list-up', 'toggle', 'details', 'advance']),
-    ...ids('crtr.setup.confirm', ['accept', 'back']),
-    ...ids('crtr.setup.keybindings', ['edit', 'commit-edit', 'cancel-edit', 'unbind', 'reset-row', 'reset-all', 'save', 'discard', 'page-up', 'page-down', 'filter', 'filter-delete', 'filter-clear']),
-    ...ids('crtr.setup', ['cell-previous', 'cell-next']),
-    ...ids('crtr.setup.models', ['open', 'scope-next', 'commit', 'cancel']),
-];
 let home;
 let realHome;
 let realCwd;
@@ -77,57 +33,6 @@ after(() => {
         process.env['HOME'] = realHome;
 });
 test.afterEach(() => rmSync(home, { recursive: true, force: true }));
-test('catalog is closed, complete, ordered, and has valid collision-free defaults', () => {
-    const actualIds = BINDING_CATALOG.map((definition) => definition.id);
-    assert.deepEqual(actualIds, REQUIRED_IDS);
-    assert.equal(actualIds.length, REQUIRED_IDS.length);
-    assert.equal(new Set(actualIds).size, actualIds.length);
-    for (const definition of BINDING_CATALOG) {
-        assert.match(definition.id, /^crtr\.[a-z0-9.-]+$/);
-        assert.ok(definition.name.length > 0);
-        assert.ok(definition.description.length > 0);
-        assert.ok(definition.contexts.length > 0);
-        for (const gesture of definition.defaults)
-            assert.equal(normalizeGesture(gesture, definition), gesture);
-    }
-    const byId = new Map(BINDING_CATALOG.map((definition) => [definition.id, definition]));
-    for (const definition of BINDING_CATALOG) {
-        if (definition.pair === undefined)
-            continue;
-        const paired = byId.get(definition.pair.pairedId);
-        assert.equal(paired?.pair?.pairedId, definition.id, `${definition.id} must have a reciprocal pair`);
-        assert.notEqual(paired?.pair?.field, definition.pair.field, `${definition.id} pair fields must differ`);
-        assert.ok(definition.pair.field === 'menu' || paired?.pair?.field === 'menu', `${definition.id} must pair with a menu selector`);
-    }
-    for (const { menuId, actionId } of ATTACH_CONTROL_BINDINGS) {
-        assert.equal(byId.get(menuId)?.pair?.field, 'menu');
-        assert.equal(byId.get(menuId)?.pair?.pairedId, actionId);
-        assert.equal(byId.get(actionId)?.pair?.field, 'direct');
-        assert.equal(byId.get(actionId)?.pair?.pairedId, menuId);
-    }
-    const resolved = resolveKeybindings();
-    assert.equal(resolved.bindings.size, BINDING_CATALOG.length);
-    assert.deepEqual(resolved.diagnostics, []);
-    assert.ok(SAFETY_REQUIREMENTS.length > 0);
-});
-test('normalizes aliases, modifier order, uppercase printables, sequences, and duplicate gestures', () => {
-    assert.equal(normalizeGesture('M-C-X'), 'ctrl+alt+shift+x');
-    assert.equal(normalizeGesture('alt+ctrl+x'), 'ctrl+alt+x');
-    assert.equal(normalizeGesture('return'), 'enter');
-    assert.equal(normalizeGesture('esc'), 'escape');
-    assert.equal(normalizeGesture('meta+j'), 'alt+j');
-    assert.equal(normalizeGesture('+'), '+');
-    assert.equal(normalizeGesture('ctrl++'), 'ctrl++');
-    assert.equal(normalizeGesture('alt+>'), 'alt+>');
-    assert.equal(formatStroke('ctrl++'), 'Ctrl++');
-    assert.equal(canonicalTerminalStroke({ input: '+', ctrl: true }), 'ctrl++');
-    const resolved = resolveKeybindings({
-        'crtr.attach.graph.toggle': ['M-X', 'alt+x'],
-        'crtr.tmux.menu.promote': ['space'],
-    });
-    assert.deepEqual(resolved.gestures('crtr.attach.graph.toggle'), ['alt+shift+x', 'alt+x']);
-    assert.deepEqual(resolved.gestures('crtr.tmux.menu.promote'), ['space']);
-});
 test('terminal literal space matches named space bindings', () => {
     const raw = { input: ' ' };
     assert.equal(canonicalTerminalStroke(raw), 'space');

package/dist/core/keybindings/background-bash.js

@@ -3,10 +3,9 @@ import { resolveUserKeybindings } from './resolve.js';
 const MENU_OPEN = 'crtr.tmux.menu.open';
 const BACKGROUND_BASH = 'crtr.tmux.menu.background-bash';
 /** The tmux menu's own shift-aware selector rendering (bare key -> itself,
- *  shift+letter -> uppercase, shift+space -> a literal space) — duplicated
- *  from the private `menuSelector` in `runtime/tmux.ts` rather than imported,
- *  since tmux.ts already pulls this module in transitively via
- *  `keybindings/index.ts` and importing back would cycle. */
+ *  shift+letter -> uppercase, shift+space -> a literal space) stays local
+ *  because `runtime/tmux-bindings.ts` consumes this module through
+ *  `keybindings/index.ts`; importing its private selector here would cycle. */
 function selectorLabel(stroke) {
     const parts = stroke.split('+');
     const key = parts.at(-1);

package/dist/core/keybindings/catalog.js

@@ -73,7 +73,7 @@ export const BINDING_CATALOG = Object.freeze([
     ...attachEntry('crtr.tmux.menu.attach.model-ladder.previous', 'crtr.attach.model-ladder.previous', 'Previous model', 'Move to the previous model ladder rung.', ['['], ['alt+shift+m']),
     ...attachEntry('crtr.tmux.menu.attach.command.inspect', 'crtr.attach.command.inspect', 'Inspect loaded command', 'Open the loaded slash command’s expanded prompt.', ['h'], ['alt+shift+h']),
     ...attachEntry('crtr.tmux.menu.attach.file-review', 'crtr.attach.file-review', 'Review a file', 'Open a line-anchored review of a file named in the transcript.', [], ['alt+shift+r']),
-    ...attachEntry('crtr.tmux.menu.attach.profile-files', 'crtr.attach.profile-files', 'Search profile files', 'Search files across the node’s profile projects, cwd, and ancestor crouter memory stores.', ['f'], []),
+    ...attachEntry('crtr.tmux.menu.attach.profile-files', 'crtr.attach.profile-files', 'Search profile files', 'Search files across the node’s profile projects, profile memory, cwd, and ancestor crouter memory stores.', ['f'], ['ctrl+f']),
     ...attachEntry('crtr.tmux.menu.attach.whip', 'crtr.attach.whip', 'Whip agent', 'Interrupt the agent and send a playful command.', ['w'], []),
     b('crtr.attach.scroll.up', 'Attach', 'Scroll up', 'Scroll the transcript one line up.', ['shift+up'], 'terminal', ATTACH_CONTEXTS),
     b('crtr.attach.scroll.down', 'Attach', 'Scroll down', 'Scroll the transcript one line down.', ['shift+down'], 'terminal', ATTACH_CONTEXTS),

package/dist/core/memory/inline-ref-grammar.js

@@ -1,7 +1,7 @@
 // inline-ref-grammar.ts — the single source of truth for the inline
-// memory-reference token grammar (spec §4.1). Zero imports, pure string ops,
-// browser-safe: the broker, terminal attach viewer, and web composer all import
-// this module directly rather than each re-implementing `[A-Za-z0-9_:-]`,
+// memory-reference token grammar (spec §4.1). The broker and terminal attach
+// viewer import these zero-dependency string operations directly rather than
+// each re-implementing `[A-Za-z0-9_:-]`,
 // trimming, boundary detection, or `:` decoding. Divergence between the
 // viewer's highlight rule and the broker's resolution rule would let a
 // highlighted token yield no guidance (or vice versa) — see the spec and

package/dist/core/memory-resolver.d.ts

@@ -81,29 +81,15 @@ export declare function listProjectMemoryDocs(startDir?: string, profileId?: str
  *  native docs are emitted before enabled-plugin docs, so native wins on the
  *  caller's first-wins dedup. */
 export declare function listAllMemoryDocs(scope?: MemoryScope, quiet?: boolean): MemoryDoc[];
-/**
- * Resolve a memory document name to a single memory document.
- *
- * Accepted identifier forms:
- *   <name>            — bare name; resolved by scope precedence project>user>builtin
- *   <scope>/<name>    — pinned to one scope (user|project)
- * `<name>` may carry topical subdirs (`taste/foo`); a bare leaf (`foo`) falls
- * back to a last-segment match within the resolved scopes.
- *
- * Strong matches resolve before fallback matches. The first pass visits every
- * source nearest-first and checks, within each source: (1) exact substrate
- * identity (`doc.name === query` — the explicit frontmatter `name`, else its
- * normalized path-derived fallback, the SAME identity `listAllMemoryDocs`
- * reports); then (2) direct `memory/<name>.md` physical-path lookup (the
- * bare-dir → INDEX.md and bare-plugin-name → plugin root INDEX.md conveniences
- * neither identity nor a literal path expresses). Only if that pass finds
- * nothing does a second nearest-first pass try bare leaf-name fallback (final
- * path segment), ambiguous when two DIFFERENT identities in the SAME source
- * share a leaf. A farther canonical identity therefore beats a nearer leaf,
- * while scope precedence still decides between equally strong matches.
- *
- * `opts.kind`, when given, is a resolution CONSTRAINT, not a post-filter: in
- * both passes a candidate whose `effectiveDocKind` doesn't match is skipped,
- * so resolution keeps looking for a matching-kind document.
- */
+export interface MemoryDocSnapshot {
+    /** Every document in default scope precedence order, loaded once. */
+    docs: readonly MemoryDoc[];
+    /** Resolve names against that source snapshot; failures are omitted so
+     * callers can retain their own per-document error behavior. */
+    resolve(names: readonly string[]): Map<string, MemoryDoc>;
+}
+export declare function createMemoryDocSnapshot(): MemoryDocSnapshot;
+/** Resolve several unqualified names over one memory-source snapshot. Failed
+ * names are omitted so callers can preserve their per-document error behavior. */
+export declare function resolveMemoryDocs(names: readonly string[]): Map<string, MemoryDoc>;
 export declare function resolveMemoryDoc(rawName: string, opts?: MemoryResolutionOpts): MemoryDoc;