@north-light/crouter 0.3.173 → 0.3.175

package/dist/core/runtime/canvas-extensions.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { basename, dirname, extname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { customExtensionPaths } from '../canvas/extensions.js';
+import { customExtensionPaths, isShippedCanvasExtension } from '../canvas/extensions.js';
 function resolveExtension(name) {
     const here = dirname(fileURLToPath(import.meta.url)); // dist/core/runtime or src/core/runtime
     const candidates = [
@@ -63,7 +63,16 @@ export function mergeCanvasExtensions(persisted) {
 export function assertMandatoryCanvasExtensions(extensions) {
     const required = new Set(CANVAS_EXTENSIONS);
     const seen = new Map();
+    const canvasBasenames = new Set();
     for (const ext of extensions) {
+        if (isShippedCanvasExtension(ext)) {
+            const filename = basename(ext.replaceAll('\\', '/'));
+            const name = filename.slice(0, filename.length - extname(filename).length);
+            if (canvasBasenames.has(name)) {
+                throw new Error(`duplicate mandatory canvas extension basename ${name}`);
+            }
+            canvasBasenames.add(name);
+        }
         if (!required.has(ext))
             continue;
         seen.set(ext, (seen.get(ext) ?? 0) + 1);

package/dist/core/runtime/fault.js

@@ -19,7 +19,7 @@ function faultPriority(fault) {
         return 2;
     return 1;
 }
-const faultLinks = ['pi→provider', 'viewer↔broker', 'relay↔broker', 'browser↔relay', 'cli→exa', 'daemon→node', 'crtr→pi'];
+const faultLinks = ['pi→provider', 'viewer↔broker', 'relay↔broker', 'viewer↔crtrd', 'cli→exa', 'daemon→node', 'crtr→pi'];
 const faultKinds = ['rate-limit', 'overloaded', 'connection', 'auth', 'protocol', 'context-overflow', 'other', 'wedged', 'model-not-found'];
 function parseFault(raw) {
     try {

package/dist/core/runtime/model-selection.d.ts

@@ -27,6 +27,15 @@ export declare const MODEL_STRENGTHS: ModelStrength[];
  *  and then fails/falls back through the normal auth-aware launch policy. */
 export declare function configuredLadderProviders(isConfigured: (runtimeProviderId: string) => boolean, ladders?: ScopeConfig['modelLadders']): ModelProvider[];
 export declare const THINKING_SUFFIXES: Set<string>;
+export declare function parseModelSpec<T extends string = string>(spec: string): {
+    modelSpec: string;
+    thinkingLevel?: T;
+};
+export declare function isUnknownModel(model: {
+    provider?: string;
+    id?: string;
+    api?: string;
+} | null | undefined): boolean;
 export declare function stripThinkingSuffix(spec: string): string;
 export interface PortableModelSelection {
     provider: ModelProvider;

package/dist/core/runtime/model-selection.js

@@ -61,6 +61,18 @@ export function configuredLadderProviders(isConfigured, ladders = modelLadders()
     return kept.length > 0 ? kept : [...MODEL_PROVIDER_KEYS];
 }
 export const THINKING_SUFFIXES = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']);
+export function parseModelSpec(spec) {
+    const i = spec.lastIndexOf(':');
+    if (i <= 0)
+        return { modelSpec: spec };
+    const suffix = spec.slice(i + 1);
+    if (!THINKING_SUFFIXES.has(suffix))
+        return { modelSpec: spec };
+    return { modelSpec: spec.slice(0, i), thinkingLevel: suffix };
+}
+export function isUnknownModel(model) {
+    return model?.provider === 'unknown' && model.id === 'unknown' && model.api === 'unknown';
+}
 export function stripThinkingSuffix(spec) {
     const i = spec.lastIndexOf(':');
     if (i <= 0)

package/dist/core/runtime/model-swap.d.ts

@@ -4,9 +4,8 @@ import { type NodeMeta } from '../canvas/index.js';
  *  or a live pid mid-boot before it binds the socket, is NOT a live broker. */
 export declare function isBrokerLive(meta: NodeMeta): boolean;
 /** Swap a LIVE node's model over its view.sock. Connects as a controller,
- *  sends `set_model`, and resolves with the broker-resolved `provider/id` on its ack —
- *  read back from the row the broker just persisted (model_changed.model carries
- *  only the bare id). Rejects with the broker's message on an `error` frame (e.g.
+ *  sends `set_model`, and resolves with the broker-resolved durable spec from its
+ *  `model_changed` frame. Rejects with the broker's message on an `error` frame (e.g.
  *  `no model matching '<spec>' in the registry`), on connect failure, or timeout.
  *  `pinned` is the durable-pin decision for this change, made by the CALLER from
  *  the RAW pre-normalize token (`spec` here is already normalizeModel-resolved,
@@ -24,4 +23,5 @@ export declare function setModelLive(nodeId: string, spec: string, pinned: boole
  *  from the RAW pre-normalize token, never re-derived here from `spec`'s shape
  *  (a concrete `spec` always reads as "pinned", which would wrongly re-pin a
  *  deliberately chosen bare tier that happens to byte-equal a ladder cell). */
+export declare function updateModelRecipe(meta: NodeMeta, spec: string, pinnedOverride: boolean | undefined, userSelected: boolean): NodeMeta;
 export declare function persistDormantModel(nodeId: string, spec: string, pinned: boolean): void;

package/dist/core/runtime/model-swap.js

@@ -4,12 +4,11 @@
 //
 //   LIVE   — the node's broker is up (recorded pi_pid alive AND view.sock
 //            present): connect to view.sock as a controller, send `set_model`,
-//            await the ack. The broker's broadcastModelChanged already persists
-//            the choice via persistModelChoice (model_override + launch.model), so
-//            this path NEVER writes the recipe itself — it reads back the resolved
-//            provider/id from the freshly-updated row.
+//            await the ack. The broker commits model_override + launch.model
+//            through crtrd before broadcasting the resolved durable spec, so this
+//            path never writes or rereads the canvas row itself.
 //   DORMANT — no live broker: write the durable recipe directly (mirroring exactly
-//            what persistModelChoice writes) so the next revive picks it up.
+//            the canonical recipe update) so the next revive picks it up.
 //
 // This complements the in-viewer `/model` slash command for the headless case.
 import { existsSync } from 'node:fs';
@@ -24,9 +23,8 @@ export function isBrokerLive(meta) {
     return isPidAlive(meta.pi_pid) && existsSync(viewSocketPath(meta.node_id));
 }
 /** Swap a LIVE node's model over its view.sock. Connects as a controller,
- *  sends `set_model`, and resolves with the broker-resolved `provider/id` on its ack —
- *  read back from the row the broker just persisted (model_changed.model carries
- *  only the bare id). Rejects with the broker's message on an `error` frame (e.g.
+ *  sends `set_model`, and resolves with the broker-resolved durable spec from its
+ *  `model_changed` frame. Rejects with the broker's message on an `error` frame (e.g.
  *  `no model matching '<spec>' in the registry`), on connect failure, or timeout.
  *  `pinned` is the durable-pin decision for this change, made by the CALLER from
  *  the RAW pre-normalize token (`spec` here is already normalizeModel-resolved,
@@ -36,20 +34,17 @@ export function isBrokerLive(meta) {
  *  from the resolved spec. */
 export function setModelLive(nodeId, spec, pinned) {
     // `set_model` carries no frame id, so the ack is matched on `for` alone.
-    let resolvedId;
+    let resolvedSpec;
     return oneShotControllerRequest({
         nodeId,
         what: 'the model switch',
         ackFor: 'set_model',
         frame: () => ({ type: 'set_model', model: spec, pinned }),
         observe: (frame) => {
-            if (frame.type === 'model_changed')
-                resolvedId = frame.model?.id;
+            if (frame.type === 'model_changed' && frame.spec !== null)
+                resolvedSpec = frame.spec;
         },
-        // The broker persisted model_override (full provider/id) in
-        // broadcastModelChanged BEFORE flushing these frames, so the row is
-        // authoritative; fall back to the bare id, then the raw spec.
-        result: () => getNode(nodeId)?.model_override ?? resolvedId ?? spec,
+        result: () => resolvedSpec ?? spec,
     });
 }
 /** Persist a model choice into a DORMANT node's durable recipe — mirrors exactly
@@ -61,16 +56,29 @@ export function setModelLive(nodeId, spec, pinned) {
  *  from the RAW pre-normalize token, never re-derived here from `spec`'s shape
  *  (a concrete `spec` always reads as "pinned", which would wrongly re-pin a
  *  deliberately chosen bare tier that happens to byte-equal a ladder cell). */
-export function persistDormantModel(nodeId, spec, pinned) {
-    const meta = getNode(nodeId);
-    if (meta === null)
-        return;
+export function updateModelRecipe(meta, spec, pinnedOverride, userSelected) {
     const launch = meta.launch === undefined
         ? undefined
-        : (() => {
-            const { modelIntent: _modelIntent, env, ...rest } = meta.launch;
-            const { CRTR_MODEL_INTENT: _intentEnv, ...remainingEnv } = env;
-            return { ...rest, model: spec, modelProviderPinned: pinned, env: remainingEnv };
-        })();
-    updateNode(nodeId, { model_override: spec, ...(launch !== undefined ? { launch } : {}) });
+        : userSelected
+            ? (() => {
+                const { modelIntent: _modelIntent, env, ...rest } = meta.launch;
+                const { CRTR_MODEL_INTENT: _intentEnv, ...remainingEnv } = env;
+                return {
+                    ...rest,
+                    model: spec,
+                    ...(pinnedOverride !== undefined ? { modelProviderPinned: pinnedOverride } : {}),
+                    env: remainingEnv,
+                };
+            })()
+            : {
+                ...meta.launch,
+                model: spec,
+                ...(pinnedOverride !== undefined ? { modelProviderPinned: pinnedOverride } : {}),
+            };
+    return updateNode(meta.node_id, { model_override: spec, ...(launch !== undefined ? { launch } : {}) });
+}
+export function persistDormantModel(nodeId, spec, pinned) {
+    const meta = getNode(nodeId);
+    if (meta !== null)
+        updateModelRecipe(meta, spec, pinned, true);
 }

package/dist/core/runtime/placement-tmux.d.ts

@@ -1,17 +1,6 @@
-export { paneExists, paneLocation, paneOfNode, paneCurrentPath, ensureSession, openNodeWindow, splitWindow, closePane, currentTmux, switchClient, selectWindow, selectLayout, selectPane, getPaneOption, setPaneOption, breakPane, inTmux, piCommand, shellQuote, installTmuxBindings, renameWindow, displayPopup, windowOfPane, respawnPaneSync, respawnPaneInPlace, paneStartCommand, panePid, windowAlive, listLivePanes, VIEWER_STAMP_OPTION, stampViewerPaneAsync, liveViewerPanes, sendAttachControl, displayClientMessage, } from './tmux.js';
-/** The shared cold-start deadline (ms) a freshly-opened viewer waits for its
- *  broker's view.sock — one source of truth for the CRTR_ATTACH_WAIT_MS a viewer
- *  pane is handed. */
-export declare const BROKER_VIEW_SOCKET_WAIT_MS = 30000;
-/** Wait until a broker's view.sock accepts a connection. The launching caller
- *  stays async, so the broker's real exit signal can fail fast the wait instead
- *  of being masked by a zombie pid. Success proves more than file existence: it
- *  is robust to a stale leftover socket the broker has not unlinked yet,
- *  because only an accepting listener yields a `connect`. */
-export declare function waitForBrokerViewSocket(nodeId: string, exited?: Promise<{
-    code: number | null;
-    signal: NodeJS.Signals | null;
-}>): Promise<boolean>;
+export { paneExists, paneLocation, paneOfNode, paneCurrentPath, paneSize, paneRunning, ensureSession, openNodeWindow, splitWindow, closePane, currentTmux, switchClient, selectWindow, selectLayout, selectPane, getPaneOption, setPaneOption, breakPane, inTmux, piCommand, shellQuote, renameWindow, displayPopup, windowOfPane, respawnPaneSync, respawnPaneInBackground, respawnPaneInPlace, paneStartCommand, panePid, windowAlive, listLivePanes, VIEWER_STAMP_OPTION, stampViewerPaneAsync, liveViewerPanes, sendAttachControl, displayClientMessage, } from './tmux-driver.js';
+export { installTmuxBindings } from './tmux-bindings.js';
+export { BROKER_VIEW_SOCKET_WAIT_MS, waitForBrokerViewSocket } from './view-socket.js';
 /** Env for a `crtr surface attach` VIEWER pane (the focus split, the spawn viewer
  *  window, AND recycle's re-attach respawn): propagate CRTR_HOME so the viewer
  *  resolves the SAME canvas home — and thus the right view.sock — under a

package/dist/core/runtime/placement-tmux.js

@@ -12,88 +12,19 @@
 // openViewerWindow composes openViewerPane (here) + registerViewerFocus (the db
 // write, which stays in placement.ts).
 //
-// §5.1 import-lint: placement-tmux.ts is an ALLOWED direct importer of tmux.ts —
-// it is the sanctioned pure-tmux seam, re-exporting the driver verbs other
-// modules need so they never import tmux.ts directly.
-import { createConnection } from 'node:net';
-import { paneLocation, ensureSession, openNodeWindow, splitWindow, selectLayout, } from './tmux.js';
-import { viewSocketPath } from '../canvas/paths.js';
-// Re-export the pure tmux driver verbs the CLI/viewer consumers need, so the
-// §5.1 lint's "only placement / tmux-chrome import tmux.ts" holds while these
-// modules never reach the canvas focuses table.
-export { paneExists, paneLocation, paneOfNode, paneCurrentPath, ensureSession, openNodeWindow, splitWindow, closePane, currentTmux, switchClient, selectWindow, selectLayout, selectPane, getPaneOption, setPaneOption, breakPane, inTmux, piCommand, shellQuote, installTmuxBindings, renameWindow, displayPopup, windowOfPane, respawnPaneSync, respawnPaneInPlace, paneStartCommand, panePid, windowAlive, listLivePanes, VIEWER_STAMP_OPTION, stampViewerPaneAsync, liveViewerPanes, sendAttachControl, displayClientMessage, } from './tmux.js';
+// §5.1 import-lint: placement-tmux.ts is an allowed direct importer of
+// tmux-driver.ts — it is the sanctioned pure-tmux seam, re-exporting the driver
+// verbs other modules need so they never import the driver directly.
+import { paneLocation, ensureSession, openNodeWindow, splitWindow, selectLayout, } from './tmux-driver.js';
+import { BROKER_VIEW_SOCKET_WAIT_MS } from './view-socket.js';
+// Re-export the pure tmux driver verbs the CLI/viewer consumers need without
+// exposing the canvas focuses table or sending command modules to the raw driver.
+export { paneExists, paneLocation, paneOfNode, paneCurrentPath, paneSize, paneRunning, ensureSession, openNodeWindow, splitWindow, closePane, currentTmux, switchClient, selectWindow, selectLayout, selectPane, getPaneOption, setPaneOption, breakPane, inTmux, piCommand, shellQuote, renameWindow, displayPopup, windowOfPane, respawnPaneSync, respawnPaneInBackground, respawnPaneInPlace, paneStartCommand, panePid, windowAlive, listLivePanes, VIEWER_STAMP_OPTION, stampViewerPaneAsync, liveViewerPanes, sendAttachControl, displayClientMessage, } from './tmux-driver.js';
+export { installTmuxBindings } from './tmux-bindings.js';
 // ---------------------------------------------------------------------------
 // view.sock readiness — the one shared broker-cold-start primitive
 // ---------------------------------------------------------------------------
-const BROKER_FOCUS_SOCKET_WAIT_MS = 30_000;
-const BROKER_FOCUS_SOCKET_RETRY_MS = 100;
-/** The shared cold-start deadline (ms) a freshly-opened viewer waits for its
- *  broker's view.sock — one source of truth for the CRTR_ATTACH_WAIT_MS a viewer
- *  pane is handed. */
-export const BROKER_VIEW_SOCKET_WAIT_MS = BROKER_FOCUS_SOCKET_WAIT_MS;
-function sleep(ms) {
-    return new Promise((resolve) => {
-        setTimeout(resolve, ms);
-    });
-}
-function probeBrokerViewSocket(sockPath, timeoutMs) {
-    return new Promise((resolve) => {
-        let settled = false;
-        let socket = null;
-        const finish = (ok) => {
-            if (settled)
-                return;
-            settled = true;
-            if (socket !== null)
-                socket.destroy();
-            resolve(ok);
-        };
-        try {
-            socket = createConnection(sockPath);
-        }
-        catch {
-            finish(false);
-            return;
-        }
-        socket.once('connect', () => finish(true));
-        socket.once('error', () => finish(false));
-        socket.setTimeout(timeoutMs, () => finish(false));
-    });
-}
-/** Wait until a broker's view.sock accepts a connection. The launching caller
- *  stays async, so the broker's real exit signal can fail fast the wait instead
- *  of being masked by a zombie pid. Success proves more than file existence: it
- *  is robust to a stale leftover socket the broker has not unlinked yet,
- *  because only an accepting listener yields a `connect`. */
-export async function waitForBrokerViewSocket(nodeId, exited) {
-    const sockPath = viewSocketPath(nodeId);
-    const deadline = Date.now() + BROKER_FOCUS_SOCKET_WAIT_MS;
-    const exitSeen = exited?.then(() => 'exit');
-    while (Date.now() <= deadline) {
-        const remaining = Math.max(0, deadline - Date.now());
-        const probe = probeBrokerViewSocket(sockPath, Math.min(BROKER_FOCUS_SOCKET_RETRY_MS, remaining)).then((ok) => (ok ? 'ready' : 'retry'));
-        // Race the probe against the broker's real exit ONLY when we have one. With
-        // no exit promise, an `?? Promise.resolve('retry')` would settle instantly
-        // and always beat the probe, so readiness could never observe a `connect`.
-        const outcome = exitSeen === undefined ? await probe : await Promise.race([probe, exitSeen]);
-        if (outcome === 'ready')
-            return true;
-        if (outcome === 'exit')
-            return false;
-        if (exitSeen !== undefined) {
-            const sleptOrExit = await Promise.race([
-                sleep(BROKER_FOCUS_SOCKET_RETRY_MS).then(() => 'sleep'),
-                exitSeen,
-            ]);
-            if (sleptOrExit === 'exit')
-                return false;
-        }
-        else {
-            await sleep(BROKER_FOCUS_SOCKET_RETRY_MS);
-        }
-    }
-    return false;
-}
+export { BROKER_VIEW_SOCKET_WAIT_MS, waitForBrokerViewSocket } from './view-socket.js';
 // ---------------------------------------------------------------------------
 // Viewer pane opener (tmux half, NO focus-row write)
 // ---------------------------------------------------------------------------
@@ -126,7 +57,7 @@ export function openViewerPane(nodeId, session, opts = {}) {
     // a literal duplicated at the call site.
     const env = {
         ...viewerSplitEnv(),
-        ...(opts.waitForBroker === true ? { CRTR_ATTACH_WAIT_MS: String(BROKER_FOCUS_SOCKET_WAIT_MS) } : {}),
+        ...(opts.waitForBroker === true ? { CRTR_ATTACH_WAIT_MS: String(BROKER_VIEW_SOCKET_WAIT_MS) } : {}),
         ...(opts.initialWhip === true ? { CRTR_ATTACH_INITIAL_WHIP: '1' } : {}),
     };
     const cwd = opts.cwd ?? process.cwd();

package/dist/core/runtime/placement.d.ts

@@ -1,7 +1,9 @@
 import { type FocusRow } from '../canvas/index.js';
 export type { FocusRow };
-export { splitWindow, breakPane, selectLayout, selectPane, focusWindow, selectWindow, switchClient, openNodeWindow, ensureSession, paneLocation, paneExists, paneRunning, paneCurrentPath, currentTmux, inTmux, paneOfNode, installTmuxBindings, installTmuxBindings as installMenuBinding, setPaneOption, getPaneOption, piCommand, shellQuote, respawnPaneSync, closePane, displayPopup, windowOfPane, renameWindow, paneOfWindow, windowAlive, listLivePanes, } from './tmux.js';
-export type { RespawnPaneOpts, TmuxInstalledPair, TmuxInstallDiagnostic, TmuxInstallResult } from './tmux.js';
+export { splitWindow, breakPane, selectLayout, selectPane, focusWindow, selectWindow, switchClient, openNodeWindow, ensureSession, paneLocation, paneExists, paneRunning, paneCurrentPath, currentTmux, inTmux, paneOfNode, setPaneOption, getPaneOption, piCommand, shellQuote, respawnPaneSync, closePane, displayPopup, windowOfPane, renameWindow, paneOfWindow, windowAlive, listLivePanes, } from './tmux-driver.js';
+export type { RespawnPaneOpts } from './tmux-driver.js';
+export { installTmuxBindings } from './tmux-bindings.js';
+export type { TmuxInstalledPair, TmuxInstallDiagnostic, TmuxInstallResult } from './tmux-bindings.js';
 /** The viewer a node has on screen, or null. UNIQUE(node_id) ⇒ at most one. */
 export declare function focusOf(nodeId: string): FocusRow | null;
 /** Does this node have a live viewer on screen? */

package/dist/core/runtime/placement.js

@@ -20,13 +20,12 @@
 //     row registrar used by BOTH spawn (a background viewer window) and focus.
 //   • tearDownNode / detachToBackground — close a node's viewer pane + row.
 //   • The chrome/viewer tmux re-exports (§2.1): placement stays the sanctioned
-//     model-over-driver so the §5.1 import-lint ("only placement.ts /
-//     tmux-chrome.ts import tmux.ts") holds — every other module reaches the
-//     driver verbs through here.
+//     model-over-driver. Raw driver access is confined to placement, its pure
+//     tmux half, the bindings owner, and tmux chrome.
 import { getNode, fullName, deleteNode, listNodes, openFocusRow, closeFocusRow, getFocusByNode, getFocusByPane, getFocusById, listFocuses as listFocusRows, } from '../canvas/index.js';
 import { nodeHasAssistantMessage, isNodeStreaming } from '../canvas/render.js';
 import { headlessBrokerHost } from './host.js';
-import { paneExists, paneLocation, closePane, currentTmux, switchClient, selectWindow, selectLayout, selectPane, getPaneOption, setPaneOption, respawnPaneSync, windowOfPane, renameWindow, } from './tmux.js';
+import { paneExists, paneLocation, closePane, currentTmux, switchClient, selectWindow, selectLayout, selectPane, getPaneOption, setPaneOption, respawnPaneSync, windowOfPane, renameWindow, } from './tmux-driver.js';
 // The PURE tmux + broker-socket half now lives in placement-tmux.ts. placement
 // composes the viewer OPENER over openViewerPane (tmux) + registerViewerFocus
 // (the db write). viewerSplitEnv + waitForBrokerViewSocket are re-exported here
@@ -36,8 +35,7 @@ import { openViewerPane, viewerSplitEnv, waitForBrokerViewSocket } from './place
 import { newJobId } from './nodes.js';
 import { isPidAlive } from '../canvas/pid.js';
 // Placement is the sanctioned model-over-driver (§2.1): non-placement runtime /
-// command modules that legitimately need a raw driver verb get it from here, so
-// the §5.1 lint can hold "only placement.ts / tmux-chrome.ts import tmux.ts".
+// command modules that legitimately need a raw driver verb get it from here.
 // These are the chrome + viewer verbs that survive the cut (the engine-in-pane
 // verbs — respawnPane, respawnPaneDetached, swapPaneInPlace, breakPaneToSession,
 // joinPane, setWindowOption, setRemainOnExit — are deleted). `breakPane` +
@@ -46,12 +44,9 @@ import { isPidAlive } from '../canvas/pid.js';
 // viewer pane into its own window and tiles sibling viewers beside it.
 // `piCommand`, `paneCurrentPath`, and `shellQuote` remain available to command
 // modules that need to build or inspect tmux pane commands without importing
-// tmux.ts directly; the §5.1 lint keeps the raw driver behind this placement
-// boundary.
-export { splitWindow, breakPane, selectLayout, selectPane, focusWindow, selectWindow, switchClient, openNodeWindow, ensureSession, paneLocation, paneExists, paneRunning, paneCurrentPath, currentTmux, inTmux, paneOfNode, installTmuxBindings, 
-// Compile seam for viewer.ts, which still calls installMenuBinding();
-// deleted when the attach unit imports installTmuxBindings directly.
-installTmuxBindings as installMenuBinding, setPaneOption, getPaneOption, piCommand, shellQuote, respawnPaneSync, closePane, displayPopup, windowOfPane, renameWindow, paneOfWindow, windowAlive, listLivePanes, } from './tmux.js';
+// tmux-driver.ts directly.
+export { splitWindow, breakPane, selectLayout, selectPane, focusWindow, selectWindow, switchClient, openNodeWindow, ensureSession, paneLocation, paneExists, paneRunning, paneCurrentPath, currentTmux, inTmux, paneOfNode, setPaneOption, getPaneOption, piCommand, shellQuote, respawnPaneSync, closePane, displayPopup, windowOfPane, renameWindow, paneOfWindow, windowAlive, listLivePanes, } from './tmux-driver.js';
+export { installTmuxBindings } from './tmux-bindings.js';
 // ---------------------------------------------------------------------------
 // Viewer registry reads — COMPOSE over the canvas focuses table (§2.3/§4).
 //

package/dist/core/runtime/promote.d.ts

@@ -1,4 +1,4 @@
-import { type NodeMeta } from '../canvas/index.js';
+import { type NodeMeta, type Mode, type Lifecycle } from '../canvas/index.js';
 export interface PromoteResult {
     meta: NodeMeta;
     roadmapWritten: boolean;
@@ -7,6 +7,19 @@ export interface PromoteResult {
     /** Absolute path to the node's goal doc (context/initial-prompt.md). */
     goalPath: string;
 }
+/** Shared reshape machinery: rewrite kind and/or model tier — and, when the
+ *  caller supplies them, mode/lifecycle — by rebuilding the launch spec so the
+ *  change is durable across a future revive. MODE-PRESERVING by default (omit
+ *  `mode`/`lifecycle` and the node's own current values carry through) — this
+ *  is what a plain `crtr node yield --kind/--model` reshape rides, with no
+ *  mode flip and no roadmap seeding. `promote()` below is a thin wrapper that
+ *  also forces mode→orchestrator and seeds the roadmap. */
+export declare function reshapeNode(nodeId: string, opts?: {
+    kind?: string;
+    model?: string;
+    mode?: Mode;
+    lifecycle?: Lifecycle;
+}, beforePersist?: () => void): NodeMeta;
 /** Promote a node to an orchestrator (mode→orchestrator), optionally
  *  specializing its kind (e.g. a `general` worker becoming a
  *  `developer.orchestrator`) and optionally also making it resident. Idempotent:

package/dist/core/runtime/promote.js

@@ -31,7 +31,7 @@ import { readGoal, goalPath } from './kickoff.js';
  *  is what a plain `crtr node yield --kind/--model` reshape rides, with no
  *  mode flip and no roadmap seeding. `promote()` below is a thin wrapper that
  *  also forces mode→orchestrator and seeds the roadmap. */
-function reshapeNode(nodeId, opts = {}, beforePersist) {
+export function reshapeNode(nodeId, opts = {}, beforePersist) {
     const node = getNode(nodeId);
     if (node === null)
         throw new Error(`unknown node: ${nodeId}`);

package/dist/core/runtime/reset.d.ts

@@ -12,7 +12,7 @@ import { respawnPaneSync } from './placement.js';
  *  general quit→done rule does NOT auto-resolve a force-killed descendant — we
  *  mark it `canceled` here via the same `cancel` event the close cascade uses. */
 export declare function reapDescendants(rootId: string): string[];
-/** Injectable host/viewer seam, so the fast-tier test drives relaunchRoot's pure
+/** Injectable host/viewer seam, so the ordinary source test drives relaunchRoot's pure
  *  DB transitions without a real broker or tmux. Each field defaults to its
  *  production verb. */
 export interface RelaunchDeps {

package/dist/core/runtime/roadmap.js

@@ -9,7 +9,7 @@
 // first refresh-with-open-work). Leaf/terminal workers write nothing.
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
-import { contextDir } from '../canvas/index.js';
+import { contextDir } from '../canvas/paths.js';
 export function roadmapPath(nodeId) {
     return join(contextDir(nodeId), 'roadmap.md');
 }

package/dist/core/runtime/spawn.d.ts

@@ -1,5 +1,6 @@
 import { type WakeOrigin } from './bearings.js';
 import { type NodeMeta, type Mode, type Lifecycle } from '../canvas/index.js';
+import { type ModelRegistryLike, type ModelRequest } from '../model-routes.js';
 export interface SpawnChildOpts {
     kind: string;
     mode?: Mode;
@@ -88,6 +89,13 @@ export declare function resolveForkSource(value: string): string;
  *  the same startup selector the front door uses (MRU covering `cwd`, else the
  *  root-profile prompt/default). */
 export declare function resolveProfileId(explicit: string | null | undefined, spawner: string | null, cwd: string): Promise<string | null>;
+/** Reject a permanently invalid launch recipe against the registry that will
+ * serve it. Registered-but-unauthenticated/cooling requests intentionally pass
+ * this authoring check so broker policy for transient availability is unchanged. */
+export declare function assertLaunchModelRegistered(request: ModelRequest | undefined, options: {
+    cwd: string;
+    profileId: string | null;
+}, registry?: ModelRegistryLike): Promise<void>;
 export interface SpawnChildResult {
     node: NodeMeta;
     /** The viewer window opened for a --root in tmux; null otherwise (a managed

package/dist/core/runtime/spawn.js

@@ -31,6 +31,8 @@ import { piSessionsRoot } from './pi-vendored.js';
 import { headlessBrokerHost } from './host.js';
 import { ensureDaemon } from '../../daemon/manage.js';
 import { readConfig } from '../config.js';
+import { modelRequestFromConfig, unregisteredConcreteModel } from '../model-routes.js';
+import { openModelRegistry } from './model-registry.js';
 // ---------------------------------------------------------------------------
 // Shared broker-launch wrapper — catch launch/preflight failures at the call
 // site, mark the node crashed, then rethrow a clear error.
@@ -161,6 +163,26 @@ export async function resolveProfileId(explicit, spawner, cwd) {
         return getNode(spawner)?.profile_id ?? null;
     return selectProfileForCwd(cwd);
 }
+function requestFromLaunch(launch) {
+    const intent = launch.modelIntent === undefined
+        ? undefined
+        : `${launch.modelIntent.family}/${launch.modelIntent.strength}`;
+    return modelRequestFromConfig(launch.model, intent, launch.modelExact === true);
+}
+/** Reject a permanently invalid launch recipe against the registry that will
+ * serve it. Registered-but-unauthenticated/cooling requests intentionally pass
+ * this authoring check so broker policy for transient availability is unchanged. */
+export async function assertLaunchModelRegistered(request, options, registry) {
+    if (request === undefined || request.kind === 'logical')
+        return;
+    const unknown = unregisteredConcreteModel(request, registry ?? await openModelRegistry(), options);
+    if (unknown === undefined)
+        return;
+    throw usage(`model '${unknown.request.spec}' is not registered in this daemon.`, {
+        received: unknown.request.spec,
+        next: 'Pass a registered provider/id, provider/tier where provider is anthropic|openai and tier is ultra|strong|medium|light, a bare tier (ultra|strong|medium|light), or a family alias (opus|sonnet|haiku).',
+    });
+}
 /** Resolve who a spawn is attributed to. A managed child needs a spine parent
  *  (explicit `--parent` or the calling node's CRTR_NODE_ID). A --root spawn
  *  does not: it is top-level by definition and the spawner identity is
@@ -200,8 +222,9 @@ export async function spawnChildPrepared(opts, beforeBrokerLaunch) {
     const wantsWorktree = opts.worktree === true;
     const nodeId = wantsWorktree ? (opts.nodeId ?? newNodeId()) : opts.nodeId;
     // Preflight: resolve every fallible input BEFORE creating the worktree or the
-    // node. `--fork-from <bad>` (resolveForkSource) and an invalid `--profile`
-    // (resolveProfileId) must fail HERE, before anything exists to clean up or
+    // node. `--fork-from <bad>` (resolveForkSource), an invalid `--profile`
+    // (resolveProfileId), and an unregistered concrete `--model` must fail HERE,
+    // before anything exists to clean up or
     // strand — catching them later (after the worktree/node are created) is what
     // let `--worktree --fork-from <bad>` leave an active node pinned to a deleted
     // cwd with an open managed_worktree. A caller-supplied `--node-id` joins this
@@ -215,6 +238,8 @@ export async function spawnChildPrepared(opts, beforeBrokerLaunch) {
     if (opts.nodeId !== undefined)
         preflightNodeId(opts.nodeId);
     const profileId = await resolveProfileId(opts.profile, spawner, opts.cwd);
+    const preflightLaunch = buildLaunchSpec(opts.kind, mode, { lifecycle, hasManager: !root, model: opts.model, cwd: opts.cwd, profileId }).launch;
+    await assertLaunchModelRegistered(requestFromLaunch(preflightLaunch), { cwd: opts.cwd, profileId });
     const forkFrom = opts.forkFrom !== undefined ? resolveForkSource(opts.forkFrom) : undefined;
     let managedWorktree;
     let spawnCwd = opts.cwd;
@@ -230,7 +255,12 @@ export async function spawnChildPrepared(opts, beforeBrokerLaunch) {
         // model/tools resolve against the CHILD's own profile + project stack, not
         // this process's ambient scope (a front-door shell has no CRTR_PROFILE_ID,
         // which silently hid every profile-scope kind override).
-        const { launch } = buildLaunchSpec(opts.kind, mode, { lifecycle, hasManager: !root, model: opts.model, cwd: spawnCwd, profileId });
+        const launch = wantsWorktree
+            ? buildLaunchSpec(opts.kind, mode, { lifecycle, hasManager: !root, model: opts.model, cwd: spawnCwd, profileId }).launch
+            : preflightLaunch;
+        if (wantsWorktree) {
+            await assertLaunchModelRegistered(requestFromLaunch(launch), { cwd: spawnCwd, profileId });
+        }
         const meta = spawnNode({
             kind: opts.kind,
             mode,
@@ -319,9 +349,9 @@ export async function spawnChildPrepared(opts, beforeBrokerLaunch) {
             throw brokerLaunchFailed(`failed to launch the broker engine for ${meta.node_id} (${meta.name}) — the node was not started.`, `Inspect the broker log for the underlying cause (${jobDir(meta.node_id)}/broker.log) and verify the pi engine can start in this environment.`);
         }
         recordPid(meta.node_id, placed.pid);
-        // Directly driven roots are not useful until their broker accepts viewers:
-        // the web composer navigates as soon as `node new --root` returns. Only a
-        // directly driven ROOT waits — a managed child (and every cron-launched
+        // A root created through `node new --root` must accept viewers before the
+        // command returns because its caller may attach immediately. Only that root
+        // waits — a managed child (and every cron-launched
         // birth) stays launch-immediate so the daemon never blocks its serialized
         // supervision loop on a birth, no matter what forwards the readiness field.
         if (attendedRoot && opts.readiness === 'await' && !await waitForBrokerViewSocket(meta.node_id, placed.exited)) {

package/dist/core/runtime/stop-guard.d.ts

@@ -13,6 +13,7 @@ export type StopAction = {
     reason: 'stalled';
     message: string;
 };
-/** Decide what to do when a node stops. Pure given the canvas + this turn's
- *  signals — the stophook supplies the signals and enacts the action. */
-export declare function evaluateStop(nodeId: string, signals: StopSignals): StopAction;
+/** Decide what to do when a node stops. crtrd supplies every current-canvas
+ * fact; the broker contributes only whether its Pi-owned background job registry
+ * is still running work. */
+export declare function evaluateStop(nodeId: string, signals: StopSignals, backgroundJobsRunning?: boolean): StopAction;